start9 also lets you run tailscale on it
Discussion
https://github.com/angristan/wireguard-install
i used to wish i could set up SSH tunnels back in the day, but they are so clunky
this installer script is so dead simple you will never want to live without wireguard tunnels ever again
a few more pieces of tooling and IMO this is essential infra gear... especially a simple script to set up an SSH connection that only goes over WG, so you don't get endlessly spammed by SSH login scanners