get_vpn_tunnels() keyed WireGuard peers with a running counter over the peer rows, so a peer added ahead of an existing one renumbered every peer after it. Whatever a consumer stores per key moved with it: netOrk's site link and tunnel check ended up on a new, offline peer and alarmed while the real tunnel was up. The key is now the interface and the start of the public key, as in napalm-linux, made URL-safe because the key is a path segment. Two peers sharing the prefix get the whole key; a row without a public key keeps its position. IPsec and OpenVPN keys were already stable. Every WireGuard key changes once with this release; netOrk carries its per-tunnel metadata across (netork#1654).