FR: tailscale cert <my-domain-name> where my-domain-name has been setup to point to a Tailnet server (100.X.X.X etc)

### What are you trying to do?

I have recently installed Tailscale on my homelab machines. Some of these run HTTPS services (Gitea, TeamCity, Proxmox, etc) and I have been using Lets Encrypt along with port forwarding on my router so that externally registered domains like gitea.mydomain.com can be accessed over HTTPS.

With Tailscale, I have gained all this wonderful security and ease-of-use of a private network, but it's now non-trivial/impossible to use Lets Encrypt in conjunction with domains names that aren't ending in ts.net.

### How should we solve this?

tailscale cert currently only works with recognised ts.net domain names.

But if I have already registered a domain such as mydomain.com and got it pointing to the 100.X.X.X address a Tailnet device/server why can't the certificate be issued with mydomain.com?

Or, is there another way to achieve what I want? It seems the long-winded approach is to follow these steps:

1. change my domain name to point to the public IP address of the router
2. enable port forwarding on the router, so that ports 80/443 access the device
3. renew using Lets Encrypt
4. remove the port forwarding
5. change my domain name back to pointing to the tailnet IP address again

What is the recommended method to achieve my aims?

I don't need these servers to be accessible outside the Tailnet, I just want to have a simple way to renew the HTTPS certs so that I don't get browser warnings etc when I try to access these services.

### What is the impact of not solving this?

I don't see an obvious way to renew the certs and eliminate browser warnings.

### Anything else?

_No response_