Hacker News Reader

In my case yes and yes, but mostly because I spread out over two cloud providers.

But it only needs to be accessible on the port WireGuard uses for communications, and WireGuard also has a nice property where it acts passively for non-wireguard packets.

So someone on the internet doesn't necessarily know the node is reachable from the internet if they try and scan it for example.

Edit: IIRC only one end of the connection needs a stable endpoint as well. IIRC WireGuard supports mobility (changing IP addresses) for one end of the connection.

afaik, both ends can move, they just send packets to the latest IP they received a valid packet from.

Not necessarily, no. All hosts talk to each other on their private (v)NIC.

I'm also doing this with internet-connected vms, but I have closed all ports using Iptables