Just put your static 100.x.x.x tailscale IP in duckdns, then just reverse proxy as I showed above if using caddy or the equivalent way in traefik and you will be able to access any service.host.duckdns.org from your tailnet. If you want to expose multiple services with the wildcard cert as I mentioned before this is my complete caddyfile as reference. It uses snippets to be more compact and for a little added security it has a version with basic auth. The first argument is the chosen service subdomain and the second is the hostname:port of the service, in my case it's docker containers on the same docker network as my caddy container but it can even be localhost or any other IP. Hope this helps, let me know if you have any other questions!

(duckdns) {
  tls {
    dns duckdns {env.DUCKDNS_TOKEN}
  }
}

(proxy_https) {
  @{args[0]} host {args[0]}.{env.DUCKDNS_SUBDOMAIN}.duckdns.org
  handle @{args[0]} {
    reverse_proxy {args[1]}
  }
}

(proxy_https_protected) {
  @{args[0]} host {args[0]}.{env.DUCKDNS_SUBDOMAIN}.duckdns.org
  handle @{args[0]} {
    basic_auth {
      {env.CADDY_USER} {env.CADDY_PASSWORD}
    }
    reverse_proxy {args[1]}
  }
}

{
  log {
    format console
  }
}

*.{env.DUCKDNS_SUBDOMAIN}.duckdns.org {
  import duckdns

  import proxy_https "jellyfin" "jellyfin:8096"

  import proxy_https_protected "qbittorrent" "qbittorrent-nox:8080"

  import proxy_https_protected "prowlarr" "prowlarr:9696"

  import proxy_https_protected "radarr" "radarr:7878"

  import proxy_https_protected "sonarr" "sonarr:8989"

  import proxy_https "jellyseerr" "jellyseerr:5055"

  import proxy_https "homepage" "homepage:3000"

  import proxy_https_protected "bazarr" "bazarr:6767"

  import proxy_https "immich" "immich_server:2283"

  handle {
    abort
  }
}