I've been doing this for a year or two with k3s + cert-manager.

Works great.

In my case everything points to a tailscale operator endpoint, which goes to nginx ingress, which routes to the appropriate pods.

It's very much a set-and-forget solution.