Yes, I think part of my assumption here is that Nginx is already inside a subnet that doesn't allow any non-tailscale traffic to hit port 80.