I've been using tailscale/tailscale-caddy[1] successfully to serve applications only on my tailnet. It says highly experimental, but it's worked just fine for me.

[1] https://github.com/tailscale/caddy-tailscale