Finally got rid of tailscale and consequentially mullvad.

Running my own (paid anonymously with bitcoin of course) endpoint/exit node via wireguard.

and all my computers oin that network use my adguard DNS with encryption.

I'm satisfied with the whole config. Just adding new devices require ssh access and little bit of manual configuration on both ends.