Hardening CI/CD for a NAT-Bound Server: Self-Hosted to Tailscale

A self-hosted GitHub Actions runner on a public repo is a remote code execution endpoint — anyone who opens a PR can run arbitrary code on your production server. This post assumes you've shipped at l