Easiest way to run SSL certs and sub-domains per service using Tailscale

Hey folks, I'm currently running a home server with a bunch of docker compose services on it and largely it works fine. I use MagicDNS on Tailscale to connect to it through various devices.

I am trying to solve two problems: (i) it annoys me that I am connecting via http and not https, so I would like to set up SSL certs; and (ii) when using Wireguard, because the URL is the same for each service with the only difference being the port number, it gives me a whole list of logins for every service in the autofill section, so I would like to have separate sub-domains for each service to avoid this.

What is the easiest way for me to handle this? I know that Tailscale does not allow sub-domains per machine (i.e. immich.machine_name.tail1234.ts.net) so I was thinking of possibly using a DuckDNS domain with a wildcard that points to my Tailscale IP, and then have Nginx sitting behind that to point to the various services.

I have so far not quite been able to get this working as this networking stuff is quite new to me, but I thought I would ask here first to see if this is the right way of going about this or even if I am just over-complicating things and there is an easier solution to my problems. Thanks in advance for your help.