gonic as the streaming server, Lidarr for library management and some of the downloads, Sonixd/Tempo as desktop/mobile clients.

Works alright for albums (downloads are a pain), probably won't really work in your case though.

Everything is running on a single-node k8s cluster (because infrastructure-as-code is awesome), but it's probably overkill for most people. https://github.com/sibwaf/Infrastructure for reference if you're interested (/selfhosted/charts - lidarr, gonic)

Shameless self-plug: I'm working on a Subsonic-compatible server which wraps yt-dlp (i.e. allows downloading from YouTube/Bandcamp and then streams it). Seems like it should work for your case of handling single tracks. It's still very much in progress (very-very slow progress) and really isn't ready for use, but if anyone is interested in following the project: https://github.com/sibwaf/Tapesonic

Yeah, no problem.

I did try wrapping Wireguard inside of xray, but didn't manage to make it work. Not sure if it's impossible, but yeah.

xray clients can work as a system-wide VPN if you're worried about usability. Just no communication between different machines connected to the same server (probably).

To be honest, I'm also not that knowledgeable about it even though I do have it running on a VPS. And can't say I'm too knowledgeable about networking/VPNs either - I do use Wireguard which I also manage, but that's about it.

So, some bulletpoints instead:

• It's kinda a pain to set up
• It's default server configuration logs all requests, so you might want to disable this
• As far as I understand, it's more of a proxy than a VPN, so you won't be able to make connections from one client to another
• It mimics standard HTTPS
• When using the "reality" protocol it successfuly mimics any website of your choosing for any unauthenticated clients by forwarding HTTPS certificates and whatnot, which protects you from active probing
• People use it to get around the Great Firewall of China

Is Wireguard a requirement? If you just want to go around censorship / hide your traffic, you can try using https://github.com/XTLS/Xray-core