It was relatively easy once I figured out that netbird doesn’t support a wildcard certificate. They just released and update that fixed that and they now support subdomains. I also do still have headscale as a backup if I need it.