Headscale provides private access to internal services without exposing them directly to the public internet.

For the homelab stack, services can stay behind the private network while Heron handles clean internal routing.