Tailscale Services looks really interesting:

Tailscale Services lets you assign stable virtual IPs (TailVIPs) to any logical resource—databases, internal APIs, even whole clusters—so you never renumber when servers move or scale.

Each service gets automatic HTTPS certs and fine-grained ACL tags, cutting both setup time and attack surface