I usually set up a bastion host that has Tailscale installed on it, with my private key stored on a yubikey. That way you need to be on the Tailscale network,

I usually set up a bastion host that has Tailscale installed on it, with my private key stored on a yubikey. That way you need to be on the Tailscale network, and have my Yubikey/PIN - makes it nice and easy for me to get on from pretty much anywhere if I need to.