I have been thinking of this myself. I think what ill do eventually is dmz a headscale coordinator instance on an old raspi and then make that internet facing for my tailscale instances. What inwant to do is go over some NIST guidelines first to harden the raspi