systemd unit to run the wireguard jail as a service. see notes at the bottom.

netns-proton.service

# forked from https://etherarp.net/network-isolation-of-services-with-systemd/index.html
# ln -s /path/to/this/file /usr/lib/systemd/system/netns-proton.service
[Unit]
After=zfs-mount.service
Description=Named network namespace "proton"
StopWhenUnneeded=true

[Service]
Type=oneshot
RemainAfterExit=yes

# run the wgjail script to create the wireguard interface
ExecStart=/tank/opt/nas1-config/scripts/wgjailr up

# remove the named network namespace
ExecStop=/tank/opt/nas1-config/scripts/wgjailr down

# once this is in place, we can:
# 1) a) sudo systemctl edit qbittorrent-nox
#    b) sudo systemctl edit xteve
# 2) add the following:
# [Unit]
# After=netns-proton.service
# Requires=netns-proton.service
# [Service]
# NetworkNamespacePath=/var/run/netns/proton