Do you really know how Wireguard works?
Updating without a reboot only works for wireguard-go. The default implementation runs in the kernel. An update to it would require kernel live patching.
Wireguard doesn’t answer to unsigned packets. Using obscure ports or even port knocking is rather pointless. It’s indistinguishable from a closed port.
I’d rather take Casaos out of the equation and target Ubuntus’ Wireguard stack instead.
Just a few thoughts:
Why are you running two HAProxy instances? You should be able to forward the traffic on your VPS to your homeserver with a firewall rule.
If that’s not an option, this should still be doable using the X-Forwarded-For
header. Instead of setting it to single value, you need to append to it:
https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/X-Forwarded-For#syntax
Not OP but DynDNS entries will always point to your current external IP and are renewed every hour.
Internally I run an AdGuard Home instance for adblocking. All my domains are rewritten by it to use the local IP while I’m in the same network.
The company behind pfSense is shady as hell:
https://opnsense.org/opnsense-com/
Also the complete and utter clusterfuck of an attempt to bring Wireguard into the FreeBSD kernel:
https://arstechnica.com/gadgets/2021/03/buffer-overruns-license-violations-and-bad-code-freebsd-13s-close-call/