Hacker News Reader

One cool trick is having (public) subdomains pointing to the tailscale IP.

This is what I do. Works great! And my caddy setup uses the DNS mode to provision TLS certs (using my domain provider's caddy plugin).