I have been experimenting with this recently. I just have tailscale pointing to adguard on a vm i use as an exit node and run nginx to handle the reverse proxy.

Tailscale can use relays if it cant find a way to make a p2p connection. Check the documentation. There is a command you can run to see whats using the relay.

I routed the dns of the vm to the tailscale adguard and it worked.

My theoretical reasoning is. Make adguard be the dns server tell tailscale to use that and then parse all rewrites and dns for the tailscale netwrok through that endpoint (including exit node which is on the same machine).

Glad im not the only one struggling with this. I was able to get nginx to give me the congratulation page via the tailscale ip for the machine but getting that routing to work with my own custom name is giving me a headache. I am probably adding an extra unnecessary layer by trying to use adguard home as a dns rewrite. If you crack it id love to hear how you achieved it.