I should read up on Tailscale more. I have been using ddclient[1] or the router's built-in dynamic DNS[2] to set up my servers / homelab. This leaves the endpoints exposed to the public internet, as the author says.

    [1]: https://github.com/ddclient/ddclient  
    [2]: https://kb.netgear.com/1058/What-is-Dynamic-DNS-DDNS