Integrate with Tailscale | authentik
https://integrations.goauthentik.io/networking/tailscale/
Tailscale requires a properly configured WebFinger endpoint at .well-known/webfinger on the domain used for your email. Set this up according to your web server or application specifications.
Using your self-hosted Authentik as an Identity Provider for Tailscale
https://blog.antsu.net/custom-tailscale-oidc-provider-with-authentik/
Another cool thing about Tailscale is that they try to keep as little information about their users as possible, and so do not have their own login mechanism, instead leaving this task to common authentication providers like Google and Microsoft, or allowing the use of any identity provider compatible with OpenID Connect, which is the case for Authentik, and the topic of this post.