Fascinating! Thanks for sharing!
Does a vpn endpoint redirect a user to a reverse proxy or something? I’ve considered running an authenticated onion service to access some less resource intensive services (gitea, etc)