Works like a charm so far, we provision them all via Ansible and use iptables to only allow access to metric endpoints via the wg0 interface.

So far, we haven't had a single issue in 6 months.