Just use wireguard as VPN and bind ssh only to that interface. You loose public access but I couldn’t think of a reason why I want other devices than my own to connect anyway. You have to make sure that ssh starts after wireguard though or it can’t bind the port.

This is not true. There are lots of places where ssh/vpn is blocked by a firewall while https usually is allowed. So if you want to access/push code while travelling it might be really helpful to have https access to the repo. That was the only reason for me to set up gitlab years ago.

You can use i3 inside xfce. I think (not sure) you can do this on a per user basis.

You can use i3 with xfce to have a menu and an icon bar if you want one.