Sharing a small project in case the approach is useful to others: I embedded the official com.wireguard.android:tunnel library into a Paperless-ngx Android client, so the app brings up its own tunnel instead of relying on the WireGuard app.
- IncludedApplications is pinned to the app's own package, so only its traffic goes through the tunnel
- Starts automatically when you're not on one of your home Wi-Fi networks (SSID), stops a few minutes after the app goes to the background
- Without Wi-Fi names it probes the Paperless API directly (a reverse proxy answering 403 from outside doesn't count as "reachable")
- Diagnostics: last handshake, DNS from the config vs. system resolver, direct DNS queries through the tunnel, TCP/HTTP checks
- Config stored encrypted with an Android Keystore key, excluded from backups
Why not just intents to the WireGuard app? On recent Android versions the broadcast doesn't reach the WireGuard app while it's stopped.
Code (GPL-3.0): https://github.com/Jumpmaster2/paperless-mobile Google Play closed test (needs 12 testers): https://groups.google.com/g/kronenpaperless-tester → https://play.google.com/apps/testing/de.koeddi.kronenpaperless
Source: r/WireGuard · by /u/MKronen91