Probably works

templates/nftables-wgrelay.conf.j2

@@ -0,0 +1,40 @@
+{{ ansible_managed | comment }}
+
+table inet wgrelay
+delete table inet wgrelay
+
+table inet wgrelay {
+    chain input {
+        type filter hook input priority 0; policy accept;
+
+        ct state established,related accept
+        ct state invalid drop
+
+        # --- traffic arriving over the tunnel -------------------------------
+        # Ping across the tunnel is useful for debugging and harmless.
+        iifname "{{ wg_interface }}" icmp type echo-request accept
+        iifname "{{ wg_interface }}" icmpv6 type echo-request accept
+
+{% for r in relays if r.direction == 'inbound' %}
+        # {{ r.name }}: only {{ r.source_allow }} may reach this listener
+        iifname "{{ wg_interface }}" ip saddr {{ r.source_allow }} tcp dport {{ r.listen_port }} accept
+{% endfor %}
+
+        # Anything else off the tunnel is not ours. This is the rule that
+        # makes "one port, one host" true rather than aspirational.
+        iifname "{{ wg_interface }}" counter drop
+
+        # --- LAN-facing relay listeners -------------------------------------
+{% for r in relays if r.direction == 'outbound' %}
+        iifname != "{{ wg_interface }}" ip saddr {{ r.source_allow }} tcp dport {{ r.listen_port }} accept
+        tcp dport {{ r.listen_port }} counter drop
+{% endfor %}
+    }
+
+    chain forward {
+        type filter hook forward priority 0; policy drop;
+        # Nothing is routed through this box, by design. Combined with
+        # net.ipv4.ip_forward=0 this is belt and braces.
+        counter
+    }
+}