I'm still toying with the best way to do this, but here is the idea: have an additional hub-and-spoke wireguard interface added to any machine that joins any network. which is only used for accessing the server