sorry for the delayed response. I ended posting on this [0] thread where they (Formal) are doing something similar.

Here's the repo [1]. I modified it a bit to post publicly and remove the details of my setup within my tailnet/flycast network.

[0] https://news.ycombinator.com/item?id=46605155

[1] https://github.com/dtkav/agent-creds