This guide manually sets up Home Assistant to use Tailscale (in lieu of DUckDNS/etc and port forwarding).
The classic DuckDNS + Let's Encrypt route is fine but require exposing a port on y our home router.
If you're commited to exposing HA to the internet (e.g. to expose other services publicly) I'd probably go the Cloudlflare Reverse-TUnnel route (albeit not free since you have to register a domain)
We harden Tailscale a bit by using the Lock feature to stop theoretical node injections into the network. 2FA has to be setup on your IdP provider (e.g. google, github, etc)
One should also have Home Assistant and IOT devices on their own VLAN, but that's outside the scope of this doc.