WireGuard at scale: setup is solved, operations aren't

Setting up a WireGuard server in 2026 is trivial. AI writes the wg0.conf , docker compose up and wg-easy is running in a minute, generating peers takes one click. The hard part hasn't been setup for years. The hard part is what happens after the second server. The moment you have two, the friction shifts. It's no longer about commands or configs. The questions change. Who has access to what? When was this peer issued? Whose pubkey lives where? How do I revoke a contractor in one place? Setup is