MagicDNS works the same as in regular Tailscale. It creates DNS names that are visible to devices connected to the VPN.

On my coax network, which is also completely isolated from any TV or internet signals, I was not getting the advertised 2.5gbps and I was getting about 4ms of latency, and they would very occasionally disconnect. I don’t know if that’s typical or if my MoCA adapters were bad.

Even if they’re all working perfectly, unlike on switched networks like Ethernet, the signal between device A and device B also uses bandwidth on the connection to device C. I don’t know if there’s some trick with different channels to lessen this effect, but there’s no switch in your MoCA network and all cables will carry all data destined for any endpoint at the same time.

I ended up replacing the most heavily used MoCA link with essentially this exact setup, including replacing the included 1gbps modules with 10gbps: https://www.youtube.com/watch?v=Z2FbzCyiNr4 Besides being over 4x faster, I don’t need to deal with ensuring that latency sensitive wireless devices are connecting to the access point on the same side of the MoCA link as the other device.

A. It’s not an OS update. It’s part of Google Play Services.
B. I’m pretty sure this applies even on Android 12 because it’s Google Play Services. Years back, Google started moving functionality like this into Google Play Services so your phone could get new features even if you had a bad manufacturer and OS updates were months or even years behind. It was introduced as a feature then.
C. This does work, but some apps (notably banking apps) block non-Google Android, even if there is no legitimate security reason for doing so. This will vary by OS and even phones running the same OS. Official GrapheneOS builds for officially supported devices probably have the best compatibility with apps in terms of the apps not blocking your phone. Maybe there are some rooted phones that patch apps to bypass “integrity” checks. Some features of your phone just will not work, even if you have a third-party OS with official support for your phone (contactless payments). Hopefully the EU gets on this and at least Europeans or people who can trick their phones into thinking they are Europeans will get some of their control back.
D. Most people can’t live without the apps that are available only on Google’s store or that require Google Play Services. That’s most apps. Even if you don’t need those specific apps, you will need to deal with other stuff like setting up Unified Push if you want to receive timely notifications. My parents are not going to set up a Unified Push gateway.

Porkbun is a registrar that also has DNS hosting, and ACME DNS challenges just need DNS hosting. I also use Porkbun and I am happy with them as a registrar, but their DNS service wasn’t working out for me and I host my DNS records on Desec. It’s working well for me after I increased some timeouts in my ACME client configuration but I can’t recommend it if you’re having problems with Porkbun because the Desec rate limits are strict and their TTLs are high and if you don’t already know what you’re doing you’re likely to spend a lot of time waiting for propagation or rate limits.

Helm is what is used for real world software deployments. It has its problems but it’s better than Docker Compose.