Tried out the wg-wrap tool, might come in handy from time to time. Neat that it was made with a local model.

Some issues:

1. `wg-wrap healthcheck` was all green even though unprivileged user namespaces was restricted via AppArmor (Debian). That check doesn't seem to work

2. DNS doesn't work (no domains resolve) if the config lists multiple servers e.g. DNS = 1.1.1.1, 1.0.0.1

3. Peer endpoints don't support domain names, only IP addresses

4. Minor: the tool doesn't add an implied /32 cidr prefix for single ip configs (common from some VPN providers).