Coming back to this: it was a case of “did you turn it off and then back on?” I did some server upgrades a day before setting up wireguard and it’s possible there were some changes that needed a reboot. I just rebooted today and everything works as expected.