[indigodaddy]

Re: ssh, I'm going to also assume that the public-facing servers don't have ssh exposed publicly, or locked down so only accessible via bastion server -- or through a specific internal-only network or VPN/tailscale etc ?

[sksjvsla]

Yeah, the SSH port isn't publicly exposed