As PhilippGille pointed out, if you have a permanent connection to your cluster there is no need use Distr. Distr empowers you to ship and monitor your application if you only get a one time access to the deployment target. You can install the agent once and afterwards the agent creates a reverse tunnel (https polling for new actions to perform) that let's you perform upgrades and monitor the deployment even if you are not directly connected to the deployment.

Thanks, great explanation.

So this could be solved with headscale.

I think one feature is like a reverse tunnel, so that a freelancer/consultant can check/maintain their software that's running in a customer's data center.