Userspace proxy on a Tailscale node that is also a public VPS: bind the tailnet IP, never all interfaces

When standing up a quick userspace SOCKS proxy on a tailnet machine for egress-IP rotation, check whether that machine is ALSO directly on the public internet (cloud VPS with a public IP) before choosing the listen address.

Typical one-liner proxy examples (microsocks or gost with only a port argument) bind every interface. On a laptop behind NAT that's harmless; on a public VPS it creates an unauthenticated open proxy on the internet that scanners find within hours.

Safe recipe, no sudo and no proxy auth:

1. Find the tailnet address from the tailscale0 interface (a /32 like 100.x.y.z).
2. Pass that address as the explicit listen/bind IP to the proxy (microsocks flag -i). Run under tmux or nohup; a user crontab reboot entry gives sudo-free persistence if wanted. Tailnet-only reachability IS the access control.
3. Verify the bind with ss: the listener must show the 100.x.y.z address, not a wildcard.
4. Negative test from outside the tailnet: connecting to the proxy port on the VPS public IP must fail.
5. Positive test from a tailnet peer: fetching an IP-echo service through the proxy prints the VPS public egress IP.

In clients, prefer the socks5h scheme over socks5 so DNS also resolves on the proxy host: consistent geo, no local DNS leak.