No need to expose any ports, no need for a bastion, no need for any complicated method of retrieving their public IP address, can use ACLs to restrict their access to other devices on the tailnet (if they're tech-savvy enough to go looking at the tailnet in the first place).
Essentially, as long as they have internet and Tailscale is running, you'll be able to connect to their device without exposing anything over the internet.
Node exporter on hosts, OpenTelemetry collector to scrape metrics and collect logs, shipping them to Prometheus and Loki, visualising with Grafana.
Day job is for an observability platform where we heavily encourage the use of (and also contribute) to the OpenTelemetry collector project, hence my use of it.
Not a whole lot to be honest. But I work with OpenTelemetry everyday for my day job, so it was a little exercise for me.
Though, OTEL does have some advantages in that It is a vendor agnostic collection tool. allowing you to use multiple different collection methods and switch out your backend easily if you wish.
I use node exporter for host metrics (Proxmox/VMs/SFFs/RaspPis/Router) and a number of other *exporters:
exportarr
plex-exporter
unifi-exporter
bitcoin node exporter
I use the OpenTelemetry collector to collect some of the above metrics, rather than Prometheus itself, as well as docker logs and other log files before shipping them to Prometheus/Loki.
Oh, I also scrape metrics from my Traefik containers using OTEL as well.
The other option is to support Home Assistant development, pay for Home Assistant Cloud and let them handle remote access for you 😁