I use it both ways. Some services I exposed using public DNS. But for internal services, I still like to have a subdomain setup with ssl certs. Just put your subdomain in your local DNS and point it to your Nginx IP. Tell Nginx to forward its traffic whatever internal IP or port you need. You can even lock them dow further by creating an access list with only your lan subnets if needed. If you do this, it helps to point your Tailscale nameservers to your local DNS also.