Pasting a comment I made in another similar thread:

I use a reverse proxy (caddy), and point a domain at my machine.ts-domain.ts.net which hosts caddy

this way I can go to service.my.domain instead of machine:port as long as I’m connected to tailscale. any devices not on my tailscale network just get bounced if they hit the domain