They are saying wireguard alone, no reverse proxy. No exposing any services at all to the outside, just tunnel in with WG and access locally.