Nice, thanks for the list! Do you have any recommendation how to tunnel from a VPS to my home server if I'm already using Tailscale? Just use any old reverse proxy like Nginx/Traefik/Caddy?

Yep, exactly. Just use the Tailscale IPs or domains in your reverse proxy config.

Caddy supports .ts.net domains and will pull the cert from the running Tailscale daemon on your system. And even better integration is coming soon, Tailscale is working on things.

Sounds great. I'm not in a rush, so maybe I'll just wait until Tailscale releases whatever they are working on.