I’m not really seeing the WireGuard aspect of this. Sounds like TLS would be fine.