One small part per post: a probe, a daily job, a trick, a trap that cost an afternoon.
A Mac sits at home behind a normal router, no public IP, no port forwarding, and I open a shell on it from a laptop anywhere. Tailscale does the network and the keys, MagicDNS gives it a name. Plus the three things to check when it stops answering.
A few machines in my Tailscale network run unattended. Instead of naming each one in the access rules, they carry one tag, and the rules talk about the tag: who may reach them, on which ports, who may SSH in. Adding a machine stops being a policy edit.
