Turns out the `wireguard` service isn't meant to be used for VPN-like
workflows (see [1]). and I'll probably have less trouble by using
`wg-quick` instead.
Nice bonus is that instead of having awfully named services running for
each peer, I only need the one service for `wg-quick` itself.
[1]: https://github.com/NixOS/nixpkgs/issues/51258