I use a hardware router with really nice encryption offloading that does not support wireguard but does support openvpn natively.

This router is in front of my 'arrrrr' subnet at home, where all my leeching servers live. This way sidechannel attacks don't work because they have no alternative path to the internet.

It's a nice setup and I have no wish to change it or to buy other hardware.