Per-app WireGuard tunnel inside the Android app (working fork, looking for feedback)

[aswanthk777]

I have searched the existing feature requests, both open and closed, to make sure this is not a duplicate request.

• Yes

The feature

#15230 recommends a VPN over the experimental network features. The downside of a device VPN is that it is always on, for every app on the phone.

I built a fork where the WireGuard tunnel lives inside the Immich Android app:

• Android per-app VPN (includeApplication): only Immich's traffic goes through it.
• Brought up only while the app is on screen or a background backup runs; dropped again when idle.
• Skipped entirely on the home network (LAN probe with bound sockets), so at home nothing changes.
• Background backups gated to "while charging", with plugging in as the trigger, app closed.
• No relay, no third-party service, no accounts: one WireGuard UDP port at home. The server is unchanged.

Fork, documentation and a release APK: https://github.com/aswanthk777/immich-homelink (HOME_LINK.md covers behaviour, setup and internals). Tested on a OnePlus running Android 16.

Two things came out of it that affect stock Immich's "Only while charging" option and may deserve separate bug reports:

1. Phones with a charge limit (OnePlus 90 %, Samsung "protect battery", Pixel adaptive charging) report not charging while plugged in. JobScheduler still starts the charging-constrained job, but WorkManager's in-process battery tracker then stops the foreground upload worker within milliseconds of its promotion. On those phones background backup never runs during a long charge.
2. Without the battery-optimisation exemption the worker is never promoted to a foreground service, so any background work that needs a service start fails silently.

I am not opening a PR: this is a large, opinionated change that touches the VPN permission and adds a native library, and large changes need discussion first. Is this something you would consider for the official app in any form (feature flag, optional module), or is it better kept as a fork? Happy to write up either finding above as a proper issue.

Platform

• Server
• Web
• Mobile

[github-actions[bot]]

This discussion has automatically been closed as it is likely a duplicate. We get a lot of duplicate threads each day, which is why we ask you in the template to confirm that you searched for duplicates before opening one. If you're sure this is not a duplicate, please leave a comment and we will reopen the thread if necessary.

[aswanthk777]

Not a duplicate: there is no existing request for a per-app WireGuard tunnel inside the mobile app (searched open and closed discussions and issues). Body updated to match the template. Please reopen.

[bo0tzz]

We're not interested in adding this