Tail scale already has a bunch of limitations for unpaid users but it’s only an extra step to set up wireguard in a container.

Honestly, I’ve had little trouble. The Gentoo Wiki and Void Handbook have a lot of overlap with OpenRC and musl, respectively.

While the documentation could be improved, the overall experience has been quite good and very stable.

I’m not trying to be unhelpful. My advice would be to steer into the terminal. Bite the bullet. I use arch and alpine for my servers but Fedora would be fine (but SELinux can be a pain with bund mounts)

Probably just go with Fedora with btrfs for snaps. It has lots of support and is a common choice for servers

To be fair, wireguard is pretty painless.