Have you checked GotoSocial’s docs on split-domain deployments?

https://docs.gotosocial.org/en/latest/advanced/host-account-domain/

It looks like something you would want. (I will admit I have no experience with it though)

Certs served by Tailscale will still be on *.ts.net domain.

Shouldn’t the F1 car be driven behind the safety car?

Oh yes, everyone, please focus on the boats. Not the cost of living crisis and unmet demands of the workers on strike. The boats—BOATS—are the problem.