None of those IPs are public so when someone external comes asking for the public IP 129.159.x.x the server will respond that it doesn't have any service running in that IP. When the service is listening to the tailscale interface and you access it through tailscale, your browser is asking the server for the content on 100.64.x.x, the tailscale IP, and so there is indeed a service on that IP. So if you want to provide a service on both the tailscale network and through the public IP, you have to use the IP 0.0.0.0 which means every interface or you can also tell nginx to listen on both the public ip and the tailscale ip. And as the other comment says, you have to allow the port connection in bot the VPS and the Oracle network, the VCN.

Sesgada? Eso me suena familiar