feat: integrate tailscale access and lock SSH/API to tailnet

terraform/servers.tf

@@ -17,6 +17,14 @@ resource "hcloud_server" "control_plane" {
     role    = "control-plane"
   }
 
+  user_data = <<-EOF
+    #cloud-config
+    package_update: true
+    runcmd:
+      - curl -fsSL https://tailscale.com/install.sh | sh
+      - tailscale up --authkey '${var.tailscale_auth_key}' --hostname '${var.cluster_name}-cp-${count.index + 1}' --ssh=false --accept-routes=false
+  EOF
+
   network {
     network_id = hcloud_network.cluster.id
     ip         = cidrhost(var.subnet_cidr, 10 + count.index)
@@ -44,6 +52,14 @@ resource "hcloud_server" "workers" {
     role    = "worker"
   }
 
+  user_data = <<-EOF
+    #cloud-config
+    package_update: true
+    runcmd:
+      - curl -fsSL https://tailscale.com/install.sh | sh
+      - tailscale up --authkey '${var.tailscale_auth_key}' --hostname '${var.cluster_name}-worker-${count.index + 1}' --ssh=false --accept-routes=false
+  EOF
+
   network {
     network_id = hcloud_network.cluster.id
     ip         = cidrhost(var.subnet_cidr, 20 + count.index)