[apenwarr]

You might like the Tailscale Machine Key approval feature. If enabled for your domain, no device can join your tailscale network unless they’re manually approved by your network’s admin or the API.