Okay so… what about using tailscale? You set as exit node your server, which is configured with gluetun to connect to a VPN (or ideally, it’s online through a router that has itself a VPN for all the connections). Then you connect through tailscale to your homeserver and exit the internet through it (which is already under a VPN).

Why don’t you just use Shelter to create a work profile on your phone? The work profile can have a second vpn connection. I do this with my homeserver. The apps that connect to the home server are installed in the work profile so they have permanent access to the homeseraer while the normal profile is on my external vpn.

Tailscale allows you to do the same except you can create keys with limited access to only certain ports (just in case you don’t want them peeking around your server).

If it’s for your personal use and no one else is going to connect, why don’t you just configure a wireguard tunnel to remotely connect to your server as if you were in LAN without exposing anything?