A Tailscale mesh that ties my VPS, home lab, and ADS-B nodes together

My ADS-B receiver is a Raspberry Pi Zero 2 W on a home VLAN. My apps run on a VPS. I want to reach both from a laptop on any network without punching holes in a firewall. A WireGuard mesh with Tailscale solves that in an afternoon.

Design rules I stick to

• Zero inbound ports on the home edge — every node dials out
• One subnet router advertising the lab VLAN instead of installing agents everywhere
• Device tags plus ACLs so the Pi can talk to the collector and nothing else
• Key expiry left on, with rotation scheduled rather than disabled for convenience

The security win is not the tunnel, it is the segmentation. Flat trust is how one compromised sensor becomes a bad weekend.