Post

Is Endpoint your VPS's hostname or its IP? WireGuard resolves a hostname once when the tunnel starts, and on a Firestick that's often before the network is up, so it stays dead until a restart. An IP there usually fixes it. Already an IP? ifconfig wg0 on the OpenBSD side shows the last handshake.

it uses IP, doesn't handshake unless I manually stop the tunnel and start again.

Then it's the boot order or the server. Quick split: on the OpenBSD box run tcpdump -ni <egress> udp port <ListenPort>, then reboot the Firestick. Nothing arriving means the Firestick side is stuck from boot. Packets arriving with no reply points at the server. Which do you see?