Plan peers rather than only the gateway
Record which devices should connect and what each needs to reach. Keep peer credentials separate and remove unused access. A VPN configuration needs a route and firewall plan that matches the intended private resources.