they can even be reachable from the internet via the use of a wireguard tunnel and DNS record