i dont have that much knowledge about security, but would it be reasonable to expose a single raspberry in a dmz behind a firewall as a headscale vps?

i mean it would be hard for an attacker to get past the physical firewall into the main network, right?

on the other hand they wouldnt need to get past the firewall if they take over the headscale server… edit: but that would also happen, if a vps hosted somewhere else, got infected, right?