Every internal tool I need sits behind SSH. Grafana, Prometheus, the staging clusters, internal AI tooling—none of it answers on a public address, and the only door is a bastion I have a key for. That is the right setup for anything with real data behind it, and I wouldn't change it.
Source: [Dev.to](https://dev.to/malusev998/why-i-built-an-ssh-config-and-tunnel-manager-for-macos-44lj)