authentik is also an oidc provider... couldn't it also be the way they auth to tailscale too?
If tomorrow I decide not to share with anyone, I don’t want to have to reconfigure stuff. I simply edit the Tailscale policy file, and (maybe) spin down my server.