This looks cool!
If this is running as a Fly app or machine, you don’t need wireguard. _api.internal will work just fine. Wireguard is just used to connect you to the same private network.
You can update a machine to get it using a new image.
When you say that machines take ~4 min to stop, do you mean when you’ve called “stop” via our API? Or your own idle logic is taking 4 min to exit?
If it’s taking a long time to stop when you call our API, it’s likely not handling sigint properly.
You can run fly logs -i <machine id> to see more about what’s happening in our infrastructure to debug stop timings.