How can we have an always on VPN

[biketool]

On my android smartphone I had an 'always on' VPN. Has anyone configured their pinephone in the same way?

I would like it to start a wireguard VPN before bringing up the wifi or mobile interfaces, as well as a kill-switch if the VPN disconnects somehow.

I had a script on a previous linux phone to always establish a SSH tunnel(similar to a VPN) to my VPS for all traffic as part of any routeable internet connection.
For the price of most VPNs other than options for switchable location(mostly for TV streaming I think) a cheap Linux(not Windows) VPS does everything, including running a bog standard VPN better and more privately than an average VPN service if you have the skills and a few minutes spread over an afternoon to set it all up.  Some services even take crypto for a more annon setup.