Now, thanks to Tailscale and Nginx Proxy Manager, I have my entire suite of self-hosted apps available on my tailnet, on a custom domain / subdomains, with auto-renewing LetsEncrypt certs. Getting traffic in/out of the proxy container was a challenge, as was HSTS. But it works!