![](https://lemmy.dbzer0.com/pictrs/image/a18b0c69-23c9-4b2a-b8e0-3aca0172390d.png)
Another option you could consider is rather than running the VPN on the pi and downloading through that, to run the VPN on your media server as you planned and instead use the pi (or your router if you can run openwrt) as the remote access point. Then you only need to worry about the performance needed for remote access
I'm not sure how tailscale works, but this is what I do with zerotier (i.e. run it on my router).
Use the buddy system. Years ago I had a work-friend, we'd just book meetings with each other a couple of times a week, go to a meeting room and just hang out, I taught him to juggle, or we'd watch an episode from a series etc.
It was fun feeling like we got away with something, but realistically nobody questioned it because we both got our work done and it was a good company where that mattered more than time spent at a desk.