WireGuard on Ubuntu 26.04 with kernel-level setup, wg CLI reference, systemd integration, NAT traversal, site-to-site peering, Tailscale vs Headscale, and iperf3 benchmarks. Every command verified on a live VM.