Don't open a port to the public internet
So: how do you get in from outside? Not by exposing port 22 on your home machine to the internet. That is about the fastest way to get yourself into trouble.
Scanning bots knock on port 22 across every IP in the world, around the clock. Put your address on the public internet and the first login attempts usually arrive before the next day.
There is a second problem, and it is more boring but harder to dodge. Your home connection almost certainly has a dynamic IP that changes every so often. Your machine is probably behind NAT, sharing one outward address with everything else on the same Wi-Fi. There was never a public address there to open.
How painful the traditional fix is
Before tools like this, opening that path meant going into the router yourself. Port forwarding, so some public port reaches the machine at home. A DDNS service to bind a hostname to whatever the IP happens to be today, or a static IP bought from your ISP. Then firewall rules, maintained by hand, to turn away everyone who is not you.
Every step has to be right. Get one wrong and you either cannot get in, or you have exposed your entire home network.
What Tailscale does
Tailscale is a WireGuard mesh. Install it on each device, sign in to the same account, and the devices build an encrypted link straight between themselves. No public entry point. No port sitting on the internet waiting to be scanned.
You do not connect using that shifting IP either. MagicDNS gives each device a name you can remember and handles the resolution. Devices behind NAT, an IP that changed overnight, you on home Wi-Fi one minute and mobile data the next — the traversal happens out of sight.
The mental model: one more address, reachable only by you
Your machine at home gains a private address. Only devices signed in to the same Tailscale account can see it or reach it. The scanning bots have no idea it exists, because it has never appeared on the public internet.
From here on your SSH connections go to that address, not to a port 22 that gets knocked on all day.
That is all three pieces. Which leaves what you use on the phone to attach.