Interestingly I just did this with my own reverse proxy recently; nginx proxy manager in a container running on the network of a Tailscale container on the same host, connected to a Tailscale exit node on internal network. Will take a look at whether this is better.