I do the same with an (almost) always-on vpn to the same pi with wireguard set up. I use Tasker on Android to auto start the wireguard tunnel if I disconnect from my home Wi-Fi. I typically only disable it if I’m running into issues with an app etc, and I’m too lazy to dig into and whitelist any relevant domain.