I'm on iPhone, i found a workaround involving having headscale set the dns using 'magicdns' or something and having that pihole join the tailnet. after that everything is mostly groovy but the individual components don't easily seem to be able to connect to a different vpn.