- move HAProxy and ACME certificate management to Portal - route application backends to Jeeves over Tailscale - restrict Jeeves backend ports to the Tailscale interface - expose Gems for remote proxy access
- enable Tailscale on Bob, Brain, Jeeves, and Rhapsody - configure the Jeeves binary cache through Tailscale MagicDNS - trust the existing workshop cache signing key