Tailscalar here. Use tailscale serve. It is a reverse proxy inside tailscaled. It will handle HTTPS certificates for you too. As an example, here’s a sample HTTP server proxied to both my tailnet via tailscale serve and to the world with Funnel.
Also as far as I know you need to use Serve in order to use Funnel.
I can use Plex on my PS5 and share it with my friends without having to do DevOps work.