Fog and sysprep.

I went with Gandi because CloudFlare doesn't give you glue records or dnssec really without an expensive account.

Guacamole with the totp plugin or reverse ssh with a key. The reverse ssh will get around just about any security if setup properly but guacamole is like pleasant to use and doesn't depend on software.

I did option 1 for a number of years but now I'm doing option 3 off a proxmox container and some cloud scripted backup. So far so good.

We just started doing option 3 at work and just keep it behind the firewall. It is going well so far.