Wireguard doesn't require much, since it is part of Linux kernel. But your use-case with http server is a good one. For similar cases I have used custom forwar

Wireguard doesn't require much, since it is part of Linux kernel. But your use-case with http server is a good one. For similar cases I have used custom forward-auth service, but that still requires to have the web server accessible, while your solution hides it completely.