I finally got around to setting up my internal services with TLS. It was surprisingly easy with a Caddy docker image supporting Cloudflare DNS challenge.

I did this because various services I use are starting to require https.

Now everything is on a custom domain, https, and I can access it through Tailscale as usual.