"
Would it not be as simple as have identical setups on both machines (xml synced) and then hook into the carp failover event and enable / disable wireguard? Both machine are able to detect whether there are the primary or not. So where the machine is the primary wireguard gets started. When its not primary, wireguard gets disabled. Would that be possible without having to hack the wireguard code but from a opnsense perspective?
