Don’t expose anything outside of the tailnet and 99% of the potential problems are gone. Noobs should not expose services across a firewall. Period.