Usage: stratum wireguard <action> [arguments]   (module type: service)

A WireGuard network: computers in different places are connected as if
they were in one network. One computer is the coordinator - it creates the
mesh, invites the others and keeps the member list. Members connect to each
other directly; when two of them cannot (both behind NAT), their traffic
goes through the coordinator (relay). The coordinator must be reachable on
its UDP port (51820) by all members.

Mesh:
  create <network> [options]    new mesh, this computer coordinates it
      --subnet 10.99.0.0/24      addresses inside the mesh (private, /16-/28)
      --port 51820               UDP port
      --endpoint auto|host[:port]  where members reach this computer
                                 (auto: its address; use a public name for
                                 members on the internet)
      --name <name>              this computer in the mesh (default: host name)
  invite <name> [address]        a new member: prints "stratum wireguard join
                                 <code>" to run there (the code is secret)
  invite-show <name>             the code again (until it is used)
  join <code> [--endpoint e]     join with an invite code
  members                        members, handshakes, direct or relay
  remove <name>                  remove a member (coordinator)
  ping <name>                    ping a member through the mesh
  leave --yes                    leave the mesh (coordinator: delete it)

Service:
  status                         mesh, settings, members
  start | stop | restart         the interface stratum-wg now
  enable | disable               on and at boot / off and not at boot
  sync                           fetch the member list now (every minute
                                 by stratum-wireguard-sync.timer)
  show                           wg show stratum-wg

Settings (setting <key> <value>):
  endpoint auto|host[:port]      where the others reach this computer
  port <1-65535>                 UDP port (default 51820)
  trust yes|no                   everything from the mesh is allowed (yes,
                                 default) or only what the firewall allows
  relay yes|no                   coordinator: relay between members (default yes)
  hosts yes|no                   member names in /etc/hosts: <name> and
                                 <name>.<network> (default yes)
  keepalive <10-120>             seconds (default 25)
  mtu <1280-1500>                MTU of stratum-wg (default 1420)

Networks behind a member: a file /etc/stratum/wireguard/routes.d/<name>.routes
with IPv4 networks (one per line) - e.g. VM Reactor writes its NAT network when
it is announced in the mesh. The coordinator publishes them to all members, which
route them through the mesh; an overlapping network is refused (the first one wins).

With stratum-firewall: the UDP port is opened, traffic from the mesh is
allowed (trust yes), and the coordinator forwards between members (relay).

Files:
  /etc/stratum/wireguard.conf, /etc/stratum/wireguard/ (keys, members)
  /var/lib/stratum-wireguard/mesh.tsv, routes.tsv, /etc/stratum/wireguard/routes.d/,
  /etc/stratum/firewall.d/wireguard.rules
  stratum-wireguard.service, stratum-wireguard-sync.timer,
  stratum-wireguard-api.service (coordinator: member list, port 51821 in the mesh)
