I got curious so I start digging into how mastodon do it. It’s more like a hack, really. Mastodon uses WebFinger to resolve user account, so when you change domain, you can leave the old domain up so your federated servers can still resolve your users and realized the domain has been changed and update their federation data. But it turns out you can’t exactly retire the old domain either because it’s still tied to user account internally. So if you lose control of your old domain, you’re probably as screwed as fmhy.ml.
I just checked my AMD box and tailscale there can consume ~15% of cpu time when the tunnel is under active use. When it’s not used it’s ~1.5%. But it’s a low power old AMD cpu though (AMD G-T56N), so I’m not use if it compares to Ryzen 5. On my intel machine, it’s ~5% when under active use, and idle at ~0.5%.