check out tsnet if you are building on tailscale anyways. your app can then be a tailnet node that can read tailnet WhoIs data and have access controlled via tailnet ACL