> with Tailscale for private access

FWIW might want to check https://github.com/wg-easy/wg-easy to remove yet another managed elsewhere piece of your setup.

Or Headscale, which has the blessing of Tailscale and contributions from some of their employees. https://github.com/juanfont/headscale

thanks for sharing, will check it out!