Remote access WireGuard v1 can use the in-app RemoteAccessVpnService fallback (TUN only). For full userspace WireGuard crypto/data plane, initialize the upstream tunnel library:

bash scripts/init-wireguard-submodule.sh

Then build with the :tunnel module (auto-included when present):

Submodule path: third-party/wireguard-android/
Gradle module: third-party/wireguard-android/tunnel
License: MIT / Apache-2.0 (see upstream COPYING)

WireGuardTunnelBridge loads com.wireguard.android.backend.GoBackend via reflection when the module is on the classpath.