Probably works

templates/socat-relay.service.j2

@@ -0,0 +1,39 @@
+{{ ansible_managed | comment }}
+[Unit]
+Description=Relay {{ item.name }} ({{ item.listen_address }}:{{ item.listen_port }} -> {{ item.target }})
+After=network-online.target wg-quick@{{ wg_interface }}.service
+Wants=network-online.target
+{% if item.direction == 'inbound' %}
+# Inbound listeners bind to the tunnel address, which doesn't exist until
+# wg-quick has brought the interface up.
+BindsTo=wg-quick@{{ wg_interface }}.service
+{% endif %}
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/socat -d \
+  TCP-LISTEN:{{ item.listen_port }},bind={{ item.listen_address }},fork,reuseaddr,keepalive,keepidle=60,keepintvl=10,keepcnt=5 \
+  TCP:{{ item.target }},keepalive,keepidle=60,keepintvl=10,keepcnt=5
+
+# Bind may fail for a few seconds after boot while wg0 settles; just retry.
+Restart=always
+RestartSec=5
+
+# socat needs no privileges beyond binding a high port.
+User={{ socat_user }}
+Group={{ socat_group }}
+NoNewPrivileges=yes
+PrivateTmp=yes
+PrivateDevices=yes
+ProtectSystem=strict
+ProtectHome=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictAddressFamilies=AF_INET AF_INET6
+RestrictNamespaces=yes
+MemoryDenyWriteExecute=yes
+CapabilityBoundingSet=
+
+[Install]
+WantedBy=multi-user.target