diff --git a/.gitignore b/.gitignore
index 6a16d6a..cd0e436 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,4 +8,4 @@ generated.yml
 
 # local runtime state
 pihole/etc-pihole/
-tailscale/
+# tailscale source files are versioned; runtime state is stored in Docker volume
diff --git a/PopuraDNS b/PopuraDNS
index ea3a9e4..584c991 160000
--- a/PopuraDNS
+++ b/PopuraDNS
@@ -1 +1 @@
-Subproject commit ea3a9e4232eebb8836d4d791880ef469f0cb1050
+Subproject commit 584c991eb12a4d1c18e6b5a5779f01b9ad39b053
diff --git a/docker-compose.arm.yml b/docker-compose.arm.yml
index 732eeb6..a0dc8be 100644
--- a/docker-compose.arm.yml
+++ b/docker-compose.arm.yml
@@ -14,7 +14,9 @@
 
 services:
   dark3proxy:
-    platform: linux/arm64
+    # 3proxy-eagle does not currently build reliably for arm64 in this repo.
+    # Keep this service on amd64 under ARM override to avoid restart loops.
+    platform: linux/amd64
 
   i2pd_yggdrasil:
     build:
@@ -36,10 +38,11 @@ services:
     platform: linux/arm64
 
   coredns:
-    platform: linux/arm64
+    # Current local CoreDNS build path is validated on amd64.
+    platform: linux/amd64
 
   unbound:
-    platform: linux/arm64
+    platform: linux/amd64
 
   pihole:
     platform: linux/arm64
diff --git a/tailscale/Dockerfile b/tailscale/Dockerfile
new file mode 100644
index 0000000..71ffcb2
--- /dev/null
+++ b/tailscale/Dockerfile
@@ -0,0 +1,16 @@
+#syntax=docker/dockerfile:1
+FROM tailscale/tailscale:latest
+
+RUN apk add --no-cache \
+    iptables \
+    socat \
+    curl \
+    bash \
+    redsocks
+
+COPY ./post-rules.sh /post-rules.sh
+COPY ./redsocks.conf /etc/redsocks.conf
+RUN chmod +x /post-rules.sh
+
+# Entrypoint to configure and start Tailscale + traffic redirection
+ENTRYPOINT ["/post-rules.sh"]
diff --git a/tailscale/post-rules.sh b/tailscale/post-rules.sh
new file mode 100644
index 0000000..b92e775
--- /dev/null
+++ b/tailscale/post-rules.sh
@@ -0,0 +1,48 @@
+#!/bin/bash
+set -e
+
+# Start Tailscale in background
+/usr/local/bin/tailscaled --tun=userspace-networking &
+TAILSCALED_PID=$!
+
+# Wait for Tailscale to initialize
+sleep 2
+
+# Authenticate with Tailscale via auth key
+if [ -n "$TS_AUTHKEY" ] && [ "$TS_AUTHKEY" != "tskey-YOUR-AUTH-KEY-HERE" ]; then
+    # tailscale up flags change over time; avoid deprecated options.
+    /usr/local/bin/tailscale up --authkey="$TS_AUTHKEY" ${TS_EXTRA_ARGS:-"--accept-dns=false --advertise-exit-node"} || true
+else
+    echo "TS_AUTHKEY is not set to a real key; skipping tailscale up"
+fi
+
+# Wait a bit for Tailscale to be ready
+sleep 3
+
+# Configure iptables to redirect all traffic through redsocks
+echo "Setting up iptables rules for traffic redirection..."
+
+# Enable IP forwarding for exit node
+sysctl -w net.ipv4.ip_forward=1 2>/dev/null || true
+sysctl -w net.ipv6.conf.all.forwarding=1 2>/dev/null || true
+
+# Create a chain for darkproxy traffic
+iptables -t nat -N DARKPROXY 2>/dev/null || iptables -t nat -F DARKPROXY
+
+# Whitelist local traffic and Tailscale
+iptables -t nat -A DARKPROXY -d 127.0.0.0/8 -j RETURN
+iptables -t nat -A DARKPROXY -d 10.5.0.0/16 -j RETURN
+iptables -t nat -A DARKPROXY -d 100.64.0.0/10 -j RETURN  # Tailscale IP range
+
+# Redirect all other TCP to redsocks  
+iptables -t nat -A DARKPROXY -p tcp -j REDIRECT --to-ports 12345
+
+# Apply chain to all output
+iptables -t nat -I OUTPUT 1 -j DARKPROXY 2>/dev/null || true
+iptables -t nat -I PREROUTING 1 -j DARKPROXY 2>/dev/null || true
+
+echo "Starting redsocks..."
+redsocks -c /etc/redsocks.conf
+
+# Keep container alive
+wait $TAILSCALED_PID
diff --git a/tailscale/redsocks.conf b/tailscale/redsocks.conf
new file mode 100644
index 0000000..b951c0d
--- /dev/null
+++ b/tailscale/redsocks.conf
@@ -0,0 +1,25 @@
+base {
+    log_debug = off;
+    log_info = on;
+    log = "stderr";
+    daemon = on;
+    redirector = iptables;
+}
+
+redsocks {
+    local_ip = 0.0.0.0;
+    local_port = 12345;
+    ip = 10.5.0.8;
+    port = 1080;
+    type = socks5;
+}
+
+redudp {
+    local_ip = 0.0.0.0;
+    local_port = 10053;
+    ip = 10.5.0.8;
+    port = 1080;
+
+    dest_ip = 10.5.0.6;
+    dest_port = 53;
+}