I've been doing this for a year or two with k3s + cert-manager. Works great. In my case everything points to a tailscale operator endpoint, which goes to ngin

I've been doing this for a year or two with k3s + cert-manager. Works great. In my case everything points to a tailscale operator endpoint, which goes to nginx ingress, which routes to the appropriate pods. It's very much a set-and-forget solution.