Thanks - appreciate another recommendation for Pangolin + crowdsec, plus I didn't know about authentik (which sounds super useful if the services behind it are compatible). I'm thinking I need to have a play around with tailscale and then Pangolin to see how they work and whether either will be appropriate for my use case.