I have a similar-ish setup, but using nomad as my executor, and traefik running on a public machine doing the routing.

Basically all the services on nomad listen on the tailnet, and traefik straddles the tailnet and the public internet. It then loads the service configurations from nomad and exposes them using let’s encrypt certificates.