> Tailscale is a VPN...

And if you use it as a VPN and don't turn on the funnel feature, your service won't be exposed.

> On the other hand, just install something like knocked and you don't have to do much. Knocking is not a difficult thing to set up.

Neither is wireguard.