Linux — server (server_mode: true) or client. Server mode enables masquerade + UFW rules; tunnels are managed by wg-quick@<iface>.service.
macOS (Darwin) — client only, via Homebrew wireguard-tools + wireguard-go. No systemd/UFW/sysctl: the config is rendered to {{ wireguard_config_base_path }} (/etc/wireguard) and brought up with wg-quick.

Verify

sudo wg show                      # Linux
sudo /opt/homebrew/bin/wg show    # macOS (or add /opt/homebrew/bin to sudo secure_path)