Go to 06 My Network -> 02 Invite Device to Network
in Script-server. Read the provided instructions and fill out the required fields. If you do not specify any keys, then they will be automatically generated and inserted into the resulting configuration file.
Install WireGuard on your mobile device.
Go to the inbox of the email address specified in Step 1 and open up the User Invitation email. Use the provided QR code image or configuration file attachment to import the configuration into WireGuard.
Download and install your public root certificate onto your device using the URL indicated in the email. See this link for more details.
Go to your home page. You should have a good trusted connection to your HomeServer, which is only reachable via your personal VPN.
The following video provides a step-by-step walkthrough, starting at the 33:52 mark:
Some cosmetic elements in Script-server, such as function names and descriptions, have been updated since the video was originally posted, but the process is the same.