Wireguard connection fails when DNS isn't working
Problem solved by changing these lines in /lib/systemd/system/[email protected]:
After=network-online.target nss-lookup.target
Wants=network-online.target nss-lookup.target
to
After=network-online.target
Wants=network-online.target
This won't work if you use domain names in your Wireguard config, but makes startup that much more reliable if you don't need DNS.