Recently learnt about tailscale funnel, and I love it, I would use for everything.

tailscale funnel --set-path <secret> <DIRECTORY>

(The path is needed because there are lots of bots who scan tailscale hostnames).

This works if the sender is tech savvy (and a tailscale user) but not in the other direction.