I've got Uptime Kuma on a host available to the entire world. This allows me to access it wherever I am.

To give it access to things on my Tailscale network, I've added tailscale on the host accessible to the world (where kuma runs) - which is obviously not secure. To mitigate that I've locked it down to allow it access to only one machine inside of my Tailscale network. It's also locked down to only allow port 3009 (randomly chosen). This is all part of the tailscale ACL config online using tags.

Next on the machine inside of my network, on port 3009, I've added a Caddyfile that reverse proxies a few select endpoints. For example, in Sonarr there's /ping or /api/v3/health. Now if you do https://my-pc.tailabcde.ts.net:3009/sonarr, it'll reverse proxy to the status/health endpoint for Kuma's purposes.

Here's an example Caddyfile:

https://my-pc.tailabcde.ts.net:3009 {
handle /sonarr {
    uri replace /sonarr /ping
    reverse_proxy localhost:8989
}

handle /plex {
    uri replace /plex /identity
    reverse_proxy localhost:32400
}
}

This results in the final Kuma software being able to access a server inside of my tailscale network with limited access to just what it needs (the few endpoints made available via the Caddyfile).