I’m not concerned about it personally, but you are putting a lot of trust in them as a 3rd party service provider. It’s up to your specific risk profile if that’s acceptable risk or not.

The alternative would probably be self hosting a vpn yourself with dyndns to handle ip address resolution. I’m biased (I have a professional networking background) but I don’t think it’s that much harder to setup either. But then I’m also a hypocrite and don’t self host anything anymore.

There’s also a valid argument to be made that doing it yourself is riskier because novices make mistakes. I don’t think this is too big of a concern personally - it’s not like you’re rolling your own cryptography.

Just as much as Tailscale is self hosting. Tailscale is probably more concerning from a security point of view.

I’d skip Active Directory but the rest seems reasonable.

Doing it all through infra as code and using ci/cd tend to be the most “devopsy” things.

I’ve never understood the point of postman. I usually just use curl