How It's Built

Internal services (n8n, Grafana, Firefly III, Solar Dashboard) are protected by Tailscale Serve, a zero-trust network boundary. This removes entire attack classes: no public reconnaissance, no credential brute force, no exploitation of unpatched CVEs. Network-level unreachability is strictly stronger than app-level hardening.