Use grants rather than ACLs, they're the "new" way of doing access control. Host a full-fledged DNS resolver inside your Tailnet (AdGuard Home, Pi-hole etc) to do adblocking and local zones, the MagicDNS custom records are very rudimentary. If you intend to integrate with a third-party UI, doublecheck which Headscale version they support and ask in the Discord, since they usually lag behind a bit. Prioritize peer relays over DERPs for performance.