[tptacek]

WireGuard is a better, safer protocol than mTLS. If you can use WireGuard, that's what you should use (often you can't, because you don't want IP addressing between your components).