at one point i tried to run my SSH behind wireguard, it can be done but it's delicate