The hardest part with bare wireguard is one part _really_ wants to be static, OR you have to re-init stuff and push DNS updates every time it updates.