Not the internal services. I have Letsencrypt setup for services on my tailnet using the Cloudflare DNS plugin for certbot so they're all over https.

Combined with only allowing connections to hosts from the Tailnet and https, forgoing passwords makes them easier to manage and use.

Granted most these personal services are things like Audiobookshelf, Nitter, Plex, and Newsblur. While important to me, they're not exactly high value targets.

My internal Gitea is locked down more and has MFA enabled since I always see git as something to secure.