[OMGWTF]

I guess you just need to configure `ListenAddress` in your `/etc/ssh/sshd_config` properly (see `man sshd_config`).

[inbetween]

You also need to change the boot behavior of sshd to wait for wireguard (tailscale in my case) to be available. I had to add a couple of lines to the ssh systemd unit.

[codetrotter]

Yep. And also pay attention during package and system upgrades on some systems. In certain cases it messes up this ordering, and you end up with sshd starting before Wireguard again and then sshd doesn’t find any interface with the specified address, which in turn makes it so that it won’t bind to that address. Making the machine unreachable until you manually fix it again.

[eyegor]

Why don't you just add sshd restart as an interface PostUp step in the client's wireguard config file?