OK, but if your threat landscape is someone burning 2 zero days (one tail scale, one webmin) you aren't likely to be posting here for answers you will have security people on call.

Geofencing is always a good option for remote access, no point in allowing someone from Spain to login when you are in Germany.