The Raspberry foundation offers a cloud service to access a raspberry device from everywhere.
The free version is limited to get access to a single user. There is also a non-free version for multiple and therefore company users.
There is no need to setup the local router or install a VPN. See https://www.raspberrypi.com/documentation/services/connect.html or https://rptl.io/rpi-connect
A device is defined by a UUID that the raspberry foundation creates once it connects to a device. Copy SD cards or using a SD card on a new device will not work. Additional there is a unique number in the hardware: cat /proc/cpuinfo | grep Serial
VERY IMPORTANT, the rpi-connect version 2.5.2 installs a graphical desktop on headless systems. If this is not desired sudo apt install rpi-connect-lite. If it gets installed accidentally then Debian is unable to identify the unnecessary packets and is unable to remove them. A fresh install is required.
If a graphical desktop is ok do sudo apt install rpi-connect or select it using sudo raspi-config or enable it even during the SD card creation within rpi-imager
To turn rpi connect on run as current user rpi-connect on and rpi-connect off would turn it off
rpi-connect signin will get a link as https://connect.raspberrypi.com/verify/<random key> that when it is opened in a web browser lets create/select an account and adds the device.
connect.raspberrypi.com is the link to re-open it later in a browser where sign in using a raspberry ID is required.
rpi-connect status, rpi-connect doctor and rpi-connect help
Devices with desktop allow to be connected via desktop sharing or console
For rpi-connect-lite a user needs to enter the command rpi-connect on after a reboot.
This can be automated by a user systemd service that is run without having the user logged in.
important is that this service is started without the user needs to be logged in.
This is done by sudo loginctl enable-linger <username>
Then systemctl --user daemon-reload
To disable it sudo loginctl disable-linger <username>
To verify loginctl show-user <username>
rpi-connect status if it works
As dpkg -L rpi-connect-lite shows a /usr/lib/systemd/user/rpi-connect.service is provided. As systemctl --user status rpi-connect shows this service will be started but might fail.
An improved service can be used instead (as for version 2.5.2). Create a user systemd service directory mkdir -p ~/.config/systemd/user/
Add a file to it touch ~/.config/systemd/user/rpi-connect-lite.service
Add the content
[Unit] Description=RPi Connect Lite (User Service) After=network-online.target Wants=network-online.target [Service] Type=simple ExecStart=/usr/bin/rpi-connect on Restart=always RestartSec=5 [Install] WantedBy=default.target
systemctl --user enable --now rpi-connect-lite.service (--now does also systemctl --user start rpi-connect-lite.service)
Finally systemctl --user status rpi-connect-lite.service will show if the service is happy