super VS homelab

You can give us a try, https://github.com/spr-networks/super, http://supernetworks.org/. Wireguard is well integrated. We also have a tailscale plugin, and more vpn plugins on the way

Somewhat related -- with the project I work on, https://github.com/spr-networks/super, we do support wireguard peers (and also support combining that wireguard identity with a wifi peer identity as well).

Devices are provisioned by assigning or generating a wireguard keypair in the API.

Next the peers are routed together by policy and by default can't access one another. There's support for bidirectional network groups or one-way firewall rules with NAT.

One are of improvement is multicast support with wireguard, it's doable, just not ready yet.

golang-based SPR is open-source and can be run on RPi: https://github.com/spr-networks/super

> An unspoofable device identity is established with a MAC address and Per-Device Passphrase for WiFi (or a VPN Public Key for Remote Devices). From there, each device gets its own /30 subnet to exist on. Hardening and strict firewall rules block network spoofing and impersonation, and routing rules redefine connectivity between devices and to the internet.

The other thing we've been tasked to work on is load balancing across uplink interfaces, and we're happy for more feedback for how the feature should work. That's tracked under here https://github.com/spr-networks/super/issues/134. We will likely use the fwmark capabilities (which we already use for redirecting traffic to site-to-site vpn connections)

Yes -- except for limited wireguard support, usability for multicast is mostly solved. SPR services mDNS and Zeroconf/SSDP with a udp proxy[1].

[1] https://github.com/spr-networks/super/blob/main/multicast_ud...

You can look at my Omada helm chart https://github.com/frealmyr/homelab/tree/provision/.archive/k8s/home/omada which uses https://github.com/frealmyr/homelab/tree/provision/.archive/charts/app as a dependency.