You can run tailscale client on the host, not in a container. Then for the domain names, create a DNS record either in the public DNS (or I think you can do it in the internal tailscale DNS) that points a wildcard for your subdomains (*.domain.com) to the IP of the container host within the tailnet. Do “tailscale --status” on any device joined to the tailnet to see the IP addresses inside the tailnet. Then all of the devices will make their DNS request to either your upstream DNS or the internal one, they get the response back that they need to send their http request to the container host within the tailnet, it sends on the default 80 or 443 ports for http and https respectively, and then your reverse proxy handles the rest.
You can run tailscale client on the host, not in a container. Then for the domain names, create a DNS record either in the public DNS (or I think you can do it in the internal tailscale DNS) that points a wildcard for your subdomains (*.domain.com) to the IP of the container host within the tailnet. Do “tailscale --status” on any device joined to the tailnet to see the IP addresses inside the tailnet. Then all of the devices will make their DNS request to either your upstream DNS or the internal one, they get the response back that they need to send their http request to the container host within the tailnet, it sends on the default 80 or 443 ports for http and https respectively, and then your reverse proxy handles the rest.