Personally, I use headscale (self-hosted tail scale) that is open to the internet. Then my phone and all other devices use tailscale clients to connect to that. All my other services are accessed through the tailscale madic DNS service.

Nothing except headscale is open to the internet, and I can access anything I need an the server. It also doesn’t just route All traffic through my server, only the stuff to other tailscale nodes.