For CLNRest

Add relay >
Listening port: your choice
Target host: c-lightning.embassy
Target port: 3010

OR

Add proxy >
Port: your choice
Target: c-lightning.embassy:3010
Trust proxy headers: checked
Optional: download the core lightning cert and upload it in TLS Cert Upload field. This enables encryption from zeus to your core lightning instance.

In zeus:
Server address: tailrelay.<your-tailnet>.ts.net
Rest port: whatever you chose above
Rune: StartOS > Services > Core Lightning > Properties > show CLNRest Quick Connect and copy string after "?rune="
Certificate validation: disabled unless you use ld proxy with the optional step above