afics

For TLS over UDP there's DTLS [0] which is probably still problematic for your use case since it still requires the typical TLS handshake.

[0] https://datatracker.ietf.org/doc/html/rfc6347

Aye, noted. Do you support the case where nodes can not talk directly to each other and relaying is required?

I know about those. Since the whole point of innernet is making wireguard configuration simpler, I figured maybe integrating something like that is worth doing.

This looks great!

Is a TCP mode planned? This would be useful for networks where outbound UDP isn't allowed. (hotel wifi, other public wifis)

Do you plan to add automatic key rollover/expiry?

At vultr you have the option to "bring your own ip", as they call it. This really just allows you to use BGP to announce whatever prefixes you own. You could have a /40 behind each of your servers if you wanted to.

Shameless self-plug.

If you are running postfix as your mail server, you could use something like [0] (or write your own solution, utilizing a database or whatever, of course).

[0] https://github.com/afics/vmailmgrpy

Doesn't this do the same as $ rsync --inplace?