You do need a DNS service with API access for automatically creating/renewing the certificates for things that are only served over tailscale though, since they aren't publicly accessible for the letsencrypt servers to talk to.

I've got a Caddy instance setup which proxies my traffic and has dead easy integration for domain DNS registration. Super handy

Same, it's fantastic. As long as you don't need to support as many requests per second on your hardware as something like NGINX could, Caddy is the way to go.

Caddy is great, but doesn't solve the problem I was talking about on its own.

Caddy will get SSL certs automatically if it is exposed to the internet and DNS for that domain points to it, but if you are routing over tailscale exclusively Caddy can't automatically validate the domain names over ACME. There is a Caddy extension for doing DNS based validation, but that puts you back to needing a DNS provider with an API.

> There is a Caddy extension for doing DNS based validation, but that puts you back to needing a DNS provider with an API.

Yea, for clarity this is what i was describing. I use Porkbun's API and the Caddy instance isn't reachable from the internet, only local and over tailscale