Yes, there are many different ways you can accomplish this.

Your reverse proxy, as well as the upstream services, can all live inside your wireguard vpn. Of course this eliminates the need for having a registered domain or ssl encryption or publicly exposing the reverse proxy.

You can host Wireguard or any other tunnel that you want inside of a container in the VPS.

I use VPNs inside of a container because they do not grant access to my network to host machine. Then on VPS you can also host something like traefik and that would apply to the VPN container.

I used to have a CGNAt carrier, ran a VPS with an HAproxy lxc container that had Tailscale connected to my home network. HAproxy backend pointed to an on prem HAproxy with backend nodes in my home network. Was very stable. I’ve also used cloudflare tunnels. Cloudflare tunnels are much easier to setup.

However, I'd prefere not to open ports at home

But why? Opening one incoming port is not an issue if you only allow connections from the VPS in the firewall on that port. Keeping a 24/7 tunnel up is certainly possible, but it adds another layer of complexity/reliability.

I've had great success with this script. It's a script that makes a Wireguard tunnel between your local network and the VPS, so no opening of ports at home needed. It's made for Oracle VPS though, but it'd probably work elsewhere too.

My current setup is this:

Cloudflare DNS -> Caddy (VPS) -> Wireguard tunnel -> NginxPM (Home) -> services

You can just have the Wireguard tunnel go straight to docker though.