This is my setup too. I use WG-Tunnel to manage the VPN connection on my phone. It just monitors whenever you disconnect from your trusted WiFi network and automatically enables the VPN.

Only hiccup I’ve found is wireless Android Auto isn’t a fan of a VPN.

I came across ryot a while ago but didn’t have a chance to really play with it. It might be useful for something like this though. Grocy is another that comes to mind.

I see. That’s good to know, thanks.

Can you elaborate?

Ah, now I understand, thank you.

No, the OS that would be running Tailscale or Wireguard. If the OS doesn’t boot, those remote access options don’t work, which is where a KVM comes in handy, rather than having to hook up a monitor and keyboard.

Unless it doesn’t boot.

I’ve got mine on a subdomain through a Cloudflare tunnel that points to my local nginx proxy manager (with wildcard SSL certs) then to immich. You can do access control through Cloudflare as well. Quite low risk in my opinion as long as you protect it properly.

Looks like that one isn’t maintained. That page links to this one instead.