FFS! A server can't run both #Docker *and* #Wireguard on #Linux.
Docker creates a "bridge" network interface which, apparently, interferes with WireGuard.
That was a depressing evening of eliminating the impossible. Completely stopping Docker allowed my VPN to connect.
And there's no way to actually run a Docker container without the network bridge (any documentation that says otherwise is lying).
@Edent I use #freedombox which includes #nextcloud. I wonder if this means I can't run #wireguard?