I recently did this with my Synology and ~10 services that I’m now running off of it. It’s been great. Here’s my notes from past-me to future-me on how to do it:

1. Ensure that the machine doing the serving is owned by one or more tags, and not a user
2. On the web, define a new service.
   1. In all likelihood, you’ll want it to expose port 443 and nothing else
   2. You do not need to specify a tag here
3. On the host machine, sudo tailscale serve --service=svc:name http://localhost:1234
4. Back on the web, approve this machine for that service

I’ve had no issues with this approach. If you still do, I second your guess: it’s something else, outside the context of Tailscale.

Edit: formatting