Background: 15 years of experience in software and apparently spoiled because it was already set up correctly.
Been practicing doing my own servers, published a test site and 24 hours later, root was compromised.
Rolled back to the backup before I made it public and now I have a security checklist.
Just a note, while wireguard makes its own VPN tunnel, it differs slightly in that it isn't the typical VPN server with vpn connecting clients, it is more akin to a peer network. Each peer device gets it's own "server" and "client" config section in the setup file. And you share the public keys between each peer before hand, and set the IPs to use.