The wireguard-go choice now survives sudo (it is passed through env), sudo is used only when the job is not root, a configuration field with a line break is refused, only the key values of a full configuration are masked, the key file is removed when wg-quick fails, and the guide calls @main until the release. Refs #184 Task: MIL-012#3