I quite like Tailscale SSH for this, but I don’t have as many machines, so not sure how it will scale. You can definitely assign roles here to allow/deny SSH between hosts in your fleet though.

And a great how-to on building one https://www.youtube.com/watch?v=oq4LmYEFlHM

Recently discovered this great site for making these https://youwouldntsteala.website/editor.html

I mean, this is Google we’re talking about…