nodes actually reach the server over grpc with ssl. We had a feature that would push all traffic over wireguard tunnels but it was messy, so it's currently out of this release. We'll probably put it back in a future one, though.