Open the tailnet admin console from alloy mesh
Ship the firewall: firewalld, a zone per profile, tailscale exempt
Write the user-facing manual