Another approach I’ve seen is to route public access from Traefik/nginx through a single Cloudflare tunnel instead, and Tailscale/Headscale can be left for private network and server access.

The traefik box can have the single Cloudflare tunnel , and tailscsle can hang out behind the scenes.

This way tailscale funnel doesn’t need to be public.

There is the self hosted Cloudflare alternative that’s escaping my mind right now too.