Have you managed to get TLS working with a setup like this? I have a custom domain that isn't used but I'd like to point it to a machine that's on Tailscale. Do you just put your Tailscale DNS on public DNS servers or do you use an internal one? Do you use a reverse proxy to route port 80/443 to the port your app is running on?
And then internally inside of tailscale you could have your own dns server, which serves subdomains of your domain, and for all subdomains you can use the same wildcard certificate.
This also does not 'expose' your subdomains on Certificate Transparency logs
Depends, if you only want dns and nothing more, then probably dnsmasq. That's basically one of the most used dns/dhcp servers.
Otherwise you could use solutions like AdGuard Home or PiHole, which both have a Web Interface for configuration, and the ability to block ads and tracking domains.
Note that I don't use Tailscale myself, so I don't know if Tailscale 'needs' something else. But I use pure wireguard, and all of the services mentioned above work with 'pure wireguard'.
