Can I use fly + WireGuard to expose an internal web interface?

This should work fine, it’s an intended future use case. The wireguard peer hostnames are a bit different though (and not actually documented). Try using <wireguard-peer>._peer.internal and see if you have better luck? I just updated the docs you linked with that info.