all my services are always exposed for convenience but never on a standard port (except http)
After managing a fleet for a long time, I'd never do that. Tailscale or any other VPN is mandatory for me to be able to access "login" ports.
all my services are always exposed for convenience but never on a standard port (except http)