It can be just like you’ve said. You can also run tailscale directly on the system hosting a service and access it directly over the tailscale network.