Have you checked GotoSocial’s docs on split-domain deployments?

https://docs.gotosocial.org/en/latest/advanced/host-account-domain/

It looks like something you would want. (I will admit I have no experience with it though)

Certs served by Tailscale will still be on *.ts.net domain.