Worked well but always annoying toggling that on/off since all my traffic went over WG and some apps (bank, Pokemon Go, Netflix) didn’t like that my source IP was a VPS.

For the record, with wireguard you can configure AllowedIPs on the client such that internet traffic isn’t routed through the tunnel. Basically, don’t use the wildcard 0.0.0.0/0 and instead set the wireguard network and the LAN subnet that Home Assistant is on if you need to access other devices.

I’ll use any app that remains FOSS so that likely rules out most reddit apps.

You could self host bitwarden if you’re technically inclined. Or use Keepass* and just use syncthing between your devices.

I’m waiting for more comprehensive offline support, but it does look promising. DSub and Ultrasonic are other good FOSS subsonic clients (although DSub isn’t being actively developed).

EDIT: Actually looks like there has been some recent activity with DSub, which is great to see.

Syncthing, KeepassDX, F-Droid.

Although in reality, most apps I use could be plausibly replaced with other alternatives.