Not sure what you mean by "on top". All you need is to configure not just a single endpoint in each node's wireguard config, but all of them. That's still as vanilla and as "tested product" as it gets. It's just a regular wireguard configuration.