@brucexu_eth: Tailscale is absolutely amazing! Now all my servers and devices are connected via Tailscale, and I've enabled Tailscale SSH. Since then, I've basically never fiddled with Private Keys again, nor do I need to sync SSH keys everywhere. I just ssh root@ta…

Tailscale is absolutely amazing! Now all my servers and devices are connected via Tailscale, and I've enabled Tailscale SSH. Since then, I've basically never fiddled with Private Keys again, nor do I need to sync SSH keys everywhere. I just ssh root@tailscale-ip to log in. Hermes, deployed on one server, can also use Tailscale for cross-server monitoring, service deployment, and daily operations — very convenient. But recently I realized there's a risk: if a Hermes instance is shared with others or deployed on a public server and eventually gets compromised, under the original allow-all network policy, an attacker could laterally access my other servers, or even my personal computer in use. I just spent a little time configuring Tailscale Access Control, and that solved the problem. The approach is straightforward: first use tags to divide devices into personal and public-server groups, then configure network Grants and Tailscale SSH Policy separately. This time I directly created a temporary scoped OAuth client for Hermes, letting it read and back up the original policy, generate new rules, call the Tailscale API to verify, then submit the configuration, and finally run real connection tests from both directions. If doing it manually, it's not too complicated either — the core is to clearly define which tags can actively access which. My current rules are: - personal devices can connect and SSH to each other - personal can connect to public servers - public servers cannot reverse-connect to personal - public servers cannot laterally connect to each other During the process, I also hit a pitfall: Tailscale's network Grants and Tailscale SSH are two separate permission layers. Just because the network works doesn't mean SSH can log in — both sides need to be configured. This way, Hermes deployed on my internal server can still act as a management node and jump box to control other servers, but if the Hermes deployed on a public server has issues, the blast radius is limited externally — no lateral spread through the Tailnet. So awesome. Previously, this kind of internal network management, identity authentication, and permission isolation was usually infrastructure that only big companies would seriously set up. Now Tailscale has democratized it for individuals, and it's free to use. If you haven't started using it, do it now!