zlacker

You are listing conveniences, which is fair. I said the tradeoff is convenience, not security.

> "Tailscale can terminate SSH publicly"

You are now exposing services via Tailscale's infrastructure instead of your own reverse proxy. The attack surface moved, it did not shrink.