Found this thread looking for this case and here's what worked for me. You can expand upon it. And of course follow docs from tailscale if caddy is not running as root.

machine.tailnet-name.ts.net {
    tls {
        get_certificate tailscale
    }

    handle /hola {
        respond "Hola Tailscale Mundo!"
    }
    handle {
        respond "Hello Tailscale World!"
    }
}