I am trying to set up a wireguard client inside a Bastille jail - both the host and the jail are on FreeBSD 15.1.

I have encountered an error (SIOCIFCREATE2 (wg0): Invalid argument) when I try to bring up the interface.

Apparently this is because, while the host system has access to the kernel module that enables wireguard, the jail does not.

After a bit of research, it seems that the way to handle this is to put the declaration
if_wg_load="YES"
into /boot/loader.conf, or perhaps into a file inside /boot/loader.conf.d.

However, Bastille sets up /boot as a read-only filesystem.

Hence the only way I can see to fix this is to edit the fstab for this jail and change the flags for /boot to rw from ro, restart the jail, edit the necessary files, and then go back out to the host and reset the flags in fstab.

Now, call me an optimist, but I suspect the good folks behind Bastille will already have seen this problem and worked out a less awkward solution - I just can't find it anywhere. Am I missing something?

Many thanks as ever,

---WBTD.