I would say there are better methods to solve this problem these days than a script. Check out Ansible or NixOS.

Put your external facing services behind the VPN, or at least put them in a separate VLAN that’s firewalled in such a way that they can’t reach the rest of the network if they become compromised.

I would advise that you instead also connect the Windows machine to the VPS with WireGuard as 10.1.0.3, basically mirroring what you’ve done on the Ubuntu server. The routing will be a mess otherwise. Another option is running the WireGuard tunnel on your gateway with something like OPNsense.

Does the machine running the WireGuard tunnel to the VPS acts as a “router” aka gateway for the network? Otherwise the windows machine doesn’t have a return path for the connection.

Same! Which version do you use? Small or big?

myaccounttag

Why did you add this part? And you’re supposed to add a @ before the channel name. Also, is your channel really called channel-1?

DuckDNS is great but their service went offline often enough for me to actually buy a domain.