This is so great. See also https://fly.io/blog/ssh-and-user-mode-ip-wireguard/