looking into a bit - WireGuard on the Umbrel would involve installing it via SSH just on underlying Debian OS that Umbrel runs on. I strongly distrust that or my own knowledge of Umbrel's ideosyncracies wrt rewriting network configs after updates, not bringing up network interfaces on reboots, etc. I've been burned by this aspect of Umbrel before and it's exactly the kind of thing I'm trying to get away from.

It feels safest to "just use the Umbrel the way it was designed - don't fuck with its guts" and then do everything I want outside of it.

Because if I'm going to do massive surgery on the Umbrel then at that point it would just be more straightforward to rawdog a Bitcoin and Lightning node on a basic linux box at home.