I create an work profile in my android phone with Insular app from f-Droid (but there is alternatives from Google play too). And connect tailscale to home server there and put all necessary app here too. Basic profile has commercial VPN with split tunneling per app.
But I check threads and there are better alternatives.
In a walk-in closet. Hdd laying on power cable to reduce vibration, works unexpectedly good.