Tailscale automates wireguard key distribution and then layers routing, DNS, network ACLs, and other niceties on top.

For example, you can create a token that grants VPN access with inbound SSH as the only allowed traffic. Add that as a secret to GitHub Actions and now you can ad-hoc debug failing CI via `tailscale ssh`.