Getting there. Some notes to remember:

• valid certs are required. Using the staging directory for letsencrypt will prevent activitypub interactions from being received.

• ensure the origin server outbound requests are proxied: when hosting static content only, a reverse proxy is sufficient, because because responses go back out via the proxied inbound request, but activity pub servers initiate outbound requests independently which won't go via reverse proxy by default.

• tailscale exit node setup has a --exit-node-allow-lan-access switch, which preserve LAN access on a node when enabling routing via an exit node.

  Hopefully, this will be visible to a test follower on activitypub.academy.