https://xeiaso.net/blog/paranoid-nixos-aws-2021-08-11 is one of my personal favorites, as well as https://tailscale.dev/blog/headscale-funnel