A mesh VPN built on WireGuard that connects devices into a private network without manual firewall rules or a central VPN gateway. In production for private access to the AKS API servers, with sign-in through Entra ID.