I know it gives me their magicdns, like server.wackyname.ts.net, I’m talking about using my own domain.

Can you be more specific?

Do a DNS rewrite at AGH, but instead of the LAN IP make it the Tailscale IP of your NPM machine

Wouldn’t that prevent any devices that don’t have tailscale from using it even locally?

Interesting. I saw the exit node feature but didn’t look into it closely. I’ll check it out. Thanks!

This doesn’t answer the question you asked, but take a look at OpenMediaVault. It’s Debian underneath but already has pretty much everything you would need to do built in.