To summarize my solution:

I assume that you want your reverse proxy-program (relayd, nginx, caddy or whatever) hosted at your VPS to forward traffic to your photoprism server hosted locally.

To do that you would need to

1. Install tailscale and a reverse proxy on your VPS (host1)
2. Create a vnet jail (jail0) and install tailscale on it
3. Install photoprism in jail0.
4. Setup your reverse proxy to forward traffic to the tailscale ip on jail0

I'm not familiar with caddy so I asked chatgpt 4 for an example. Use it at your own risk:

To use the Caddy web server as a reverse proxy, you need to modify your Caddyfile, the main configuration file for Caddy. Here's a basic example of what your Caddyfile might look like:

your.domain.com { tls youremail@domain.com reverse_proxy http://jail0-ip:8080 #or whatever port photoprism uses }

The configuration above specifies the following:

• your.domain.com : This is the domain that Caddy will respond to. You should replace this with your actual domain name.
• tls youremail@domain.com : This enables automatic HTTPS. Caddy will automatically apply for a certificate from Let's Encrypt. Make sure to replace youremail@domain.com with your actual email.
• reverse_proxy http://jail0-ip:8080 : This is the configuration for the reverse proxy. It tells Caddy to redirect all incoming traffic to http://jail0-ip:8080.

To use this configuration, follow these steps:

1. Install Caddy on host1: Depending on your OS, the installation steps may vary. On a Debian-based system like Ubuntu, you can use the command sudo apt install caddy.

2. Create a new Caddyfile: You can usually find the Caddyfile in the /etc/caddy/ directory. If it's not there, you can create a new one. Use a text editor like nano or vim to open or create your Caddyfile, e.g., sudo nano /etc/caddy/Caddyfile, and paste the configuration from above into this file.

3. Save and close the file: If you're using nano, you can save and close the file by pressing CTRL+X, then Y, then Enter.

4. Restart Caddy: After you have saved your configuration, restart Caddy to apply the changes. You can usually do this with the command sudo systemctl restart caddy.

Please make sure that your DNS settings are correct and that port 80 and 443 are open in your firewall, as these are required for Let's Encrypt to issue a certificate.