Let's say I have the domain name domain.blip with a registrar and have the ability to modify the DNS records to my liking. And let's also say I have a few computers on Tailscale with multiple family members participating.

Currently, I have HTTPS support on tailscale via a reverse proxy (nginx proxy man) where I have to update the records every 3 months using tailscale cert. This works, but it has drawbacks. For one, subdomain resolution isn't trivial without connecting all computers to a DNS server like pihole or equivalent. Additionally, all users need to remember the somewhat arbitrary tailscale network name and path to the service. With multiple services working in tandem on the same server, this can mean breaking the abstraction of the network. Lastly, there's the simple hassle of updating the self-signed certs every 3 months compared to, say, let's encrypt which can automate the process.

This is where domain.blip comes to mind. Let's say I wanted a gitea to be available at gitea.domain.blip but, importantly, I want this to be available only for local network users (on the tailscale) and to simply resolve to a generic 404 for non-tailscale users.

Is this possible to do while using a service like Let's Encrypt to automate the SSL ticket creation? Obviously the reverse proxy on the home server would have to handle the other hostname itself, but it should be possible to resolve to a website hosted on a non-public IP address right?

Thanks for anyone who has insights here. I'm also just interested to hear people's experience running a similar setup, even if we're talking about wireguard instead of tailscale.

We run a headscale service that exposes a magic dns for the tailscale clients. Everything that needs to be reachable gets an entry in a static ip table with names {service}.ts.example.com resolved by headscale's magic DNS. Everything is accessible in the tailscale network and nothing from outside of it.

We did not enable https for inside the TS network since it's all wireguard anyhow.

I do more or less exactly this.

CloudFlare domain that has a bunch of listings which point to my reverse proxy, which is only available via Tailscale.

I then share that proxy node and a TSIDP node with the tailnets of my "users" (this avoids the user limit, they don't have to switch between tailnets, and I don't need to share a new machine wherever I add a new app)

They go to the public URL of a given app > CloudFlare sends them to the proxy > they authenticate via TSIDP > and are auto logged into the app.

So far, works pretty well.