I use vanilla Wireguard (the "wg" command and the "wg-quick" service). I set up new hosts and update peer configuration using Fabric tasks. It may sound messy, but works fine in practice. For example, to set up Wireguard on a new host:

* On the new host, I run a Fabric task which generates a key pair and spits out the public key. The private key never leaves the server.

* I paste the public key in a peer configuration template.

* On every host that must be able to contact the new host, I run another Fabric task which updates the peer configuration from the template ("wg syncconf").

One thing to watch out is any services that bind to the Wireguard network interface. I had to make sure on reboot they start after wg-quick.