good start, but in the next iteration (as you’re the dabbler) try to replace tailscale with wireguard. the majority of that stack is not needed for your scenario, and you’ll also not dick around with authentication and such.

Good ideas. Very well explained.