I have a WireGuard VPN with about 250 devices, most of them POS machines in the wild. I adopted WireGuard for our first machines about half a year before the 1.

I have a WireGuard VPN with about 250 devices, most of them POS machines in the wild. I adopted WireGuard for our first machines about half a year before the 1.0 release, so there weren't much tools yet. I piggybacked onto the original configuration file format and built myself https://github.com/WolleTD/wg-setup https://github.com/WolleTD/wg-setup, which helps me validating the correctness and uniqueness of new entries, hacks names into the entries and even updates an internal DNS zone. I really don't have to care much for key rotation, though. As most of the devices are out of our control anyway, they aren't allowed to connect to anything inside the VPN. It's just for us to connect to them.