[tschumacher]

My implicit suggestion was that clients make a GraphQL request not only before the first connection but before every connection. The gateway server can insert the keys into the kernel in response to an explicit GraphQL request instead of in response to some complicated packet sniffing.

[rudasn]

What would the payload of the grapphql request to fetch the wg config for that peer look like, when they don't know from which peer the request is coming from?

[mrkurt]

This needs to support any ol' wireguard client. We use it in `flyctl` but people also use it to create gateways so they can, eg, peer with VPCs.