[predkambrij]

One cool trick is having (public) subdomains pointing to the tailscale IP.

[timwis]

This is what I do. Works great! And my caddy setup uses the DNS mode to provision TLS certs (using my domain provider's caddy plugin).