The approach my team takes is we put Wireguard gateways running on OpenBSD in front of network services. We go a step further and very carefully select what chi

The approach my team takes is we put Wireguard gateways running on OpenBSD in front of network services. We go a step further and very carefully select what chips are used for the network interfaces and also attach a hardware random number generator to add to entropy. Internal users' machines have these tunnels transparently loaded and running, configured by our internal GitOps-driven config management (SaltStack). Has been pretty comfy so far.