Let's say I have the domain name domain.blip with a registrar and have the ability to modify the DNS records to my liking. And let's also say I have a few computers on Tailscale with multiple family members participating.

Currently, I have HTTPS support on tailscale via a reverse proxy (nginx proxy man) where I have to update the records every 3 months using tailscale cert. This works, but it has drawbacks. For one, subdomain resolution isn't trivial without connecting all computers to a DNS server like pihole or equivalent. Additionally, all users need to remember the somewhat arbitrary tailscale network name and path to the service. With multiple services working in tandem on the same server, this can mean breaking the abstraction of the network. Lastly, there's the simple hassle of updating the self-signed certs every 3 months compared to, say, let's encrypt which can automate the process.

This is where domain.blip comes to mind. Let's say I wanted a gitea to be available at gitea.domain.blip but, importantly, I want this to be available only for local network users (on the tailscale) and to simply resolve to a generic 404 for non-tailscale users.

Is this possible to do while using a service like Let's Encrypt to automate the SSL ticket creation? Obviously the reverse proxy on the home server would have to handle the other hostname itself, but it should be possible to resolve to a website hosted on a non-public IP address right?

Thanks for anyone who has insights here. I'm also just interested to hear people's experience running a similar setup, even if we're talking about wireguard instead of tailscale.