I have been experimenting with this recently. I just have tailscale pointing to adguard on a vm i use as an exit node. And run ndinx to handle the reverse proxy.