Why I still run hub-and-spoke WireGuard in 2026 (and what breaks at server #2)

In 2026, "just use Tailscale" is the default answer to anything WireGuard-shaped, and for most people it's the right one. This post is for the cases where it isn't — regulated egress, fixed-IP allowlists, agentless contractor access, MSP per-client isolation — and where you end up running a small fleet of classic publicly addressable WG servers on purpose. Setting up one of those servers in 2026 is trivial. AI writes the wg0.conf , docker compose up and wg-easy is running in a minute, generating