Tailscale is a VPN solution. Adding VPN to go out just to come back in to an Apple TV or iPad 10 feet away makes no sense. I see that you don’t have anyone on the dev team that does encryption or web auth and I understand the limitation for a small company. The one caveat is that our team does do encryption and auth and we follow standard practice on installs.
We do not install our smart homes with any containers with host network access ingress. All of our services require pass through nginx. This includes services available to home network devices as our DNS implementation integrates with our services assignment.
This is a fancy way of saying, I have the app up and working and can access it from both inside and outside of the network via web browser. The apps (at least Apple apps, I see a thread that you update Android to work with host names) require either a hardcoded IP address with no security, or the getchannels url. This breaks the ability for any integrations with smart home features, adds a new hosting provider to the mix, and disables encryption.
The whole ecosystem is amazing, but this simple issue of the iOS apps requiring a hardcoded IP rather than a host name with SSL limits it’s ability to become an approved vendor for our ecosystem. I don’t specialize in iOS development, but I believe adding support for custom URLs and using SSL encryption is a rather easy portion of dev. Is it at least on the roadmap currently? I could continue to test in a sandbox to build it into our offering. If Tailscale is the only plan, then I need to move on.