Comment by zchrykng

You do need a DNS service with API access for automatically creating/renewing the certificates for things that are only served over tailscale though, since they aren't publicly accessible for the letsencrypt servers to talk to.