Allow only exposing services over Tailscale

This works using public DNS, so doesn't need Tailscale's magic DNS to override my local.

ansible/roles/ingress/files/nginx.conf

@@ -9,6 +9,8 @@ access_log /var/log/nginx/access.log access;
 server {
     listen 443;
     listen 8448;
+    listen [::]:443;
+    listen [::]:8448;
     proxy_pass {{ pve_hosts.docker.ip }}:443;
     proxy_protocol on;
     proxy_socket_keepalive on;