All hosts use Tailscale, it is necessary to have ports open to anything but the tailnet (except for Plex local traffic). Lock down the firewall