I have Tailscale set up for my home server and a public domain for internal services (to make SSL easy). The domain points to the local IP address (192.168.178.X) and mapdns to the Tailscale IP (100.78.X.X). I then configured Tailscale to search for <my domain> using the mapdns server.
Now I can resolve my local network device with the same SSL-protected domain, no matter if I'm out and about using VPN or at home.