Wireguard port is the only port that could be exposed to the Internet.

With xz backdoor owning ssh, I wouldn’t completely trust ssh public key authentication either.