A (potentially minor) problem with this use case for Tailscale is that we do actually want the forwarded services listening on localhost and not on a different

A (potentially minor) problem with this use case for Tailscale is that we do actually want the forwarded services listening on localhost and not on a different IP address, because browsers treat these as secure contexts without having to fuss with https. I briefly checked the Tailscale userspace docs just now and it seems to expose a SOCKS proxy, meaning that we'd need an extra piece to listen on the desired localhost port and forward via Tailscale. [edit] Removed an incorrect assumption. Tailscale does not require CAP_NET_ADMIN in userspace mode.