Tailscale Network Topology

Every machine in theLAB joins a single Tailscale tailnet — a private WireGuard mesh where each node gets a stable 100.x address and a name, reachable from anywhere without opening router ports.

#Why it's the backbone

• No public SSH. Port 22 is never internet-exposed; you reach hosts over the tailnet (SSH Hardening).
• Name-based access. ssh jedi@adi-cortex just works from any enrolled device.
• Jump hosts. Some nodes (e.g. adi-cloud-1) are reached via an adi-cloud-2 jump.

tailscale status                 # see the whole fleet
ssh -J jump-host user@target     # hop through a jump box

#Tailscale Serve vs Cloudflare

Two ways services get exposed, by audience:

Harden it with ACLs — Tailscale ACLs restrict which nodes can reach which, so a compromised device can't roam freely. See Firewall with ufw and nftables.

Related: theLAB Fleet Map · Tailscale Serve on 443 While Apache Stays on 80 · SSH Hardening