Many people equate the word "daemon" with the word "demon", implying some kind of satanic connection between UNIX and the underworld. This is an egregious misunderstanding. "Daemon" is actually a much older form of "demon"; daemons have no particular bias towards good or evil, but rather serve to help define a person's character or personality. The ancient Greeks' concept of a "personal daemon" was similar to the modern concept of a "guardian angel"—eudaemonia is the state of being helped or protected by a kindly spirit. As a rule, UNIX systems seem to be infested with both daemons and demons.
I think I can create a CNAME record for *.media to point to the Tailscale address of the reverse proxy
This approach, but if you setup your server to advertise subnets you can use your local IP range instead of tailscale's. Port numbers for individual services would be handled by your reverse proxy, you can setup a subdomain route for each service.
Instead of having to keep track of bookmarks you can use something like homepage on the root of your domain, as a dashboard to navigate to all other services.
My setup just has the local IP (of the reverse proxy) in the domain's DNS records, and I have Tailscale on my home server setup to advertise subnet routes, so I can use the same local IP when at home or remote via Tailscale. No need to use your public IP or open ports or anything.
You can look into selfhosting Forgejo! No paywalls, and super fast, especially compared to Gitlab