Selfhosted

Well, congrats to you. But as I said - on the same hardware, AGH runs so much smoother and more reliably. Maybe piHole is more reliable now - but back when I was using it, upgrades would kill configs, you'd have to reinstall -- it was a common thing every few months. Forgot to mention, AGH also runs on BSD, which means you can run it on your Opsense / pFsense box too if you run one.

AFAIK, instead of forwarding your DNS requests to an upstream DNS provider (eg. 1.1.1.1), it resolves the domain step by step. First, it asks the root nameserver “where's org.?”, the returned server is asked “where's example.org.?”, the returned server is asked “where's www.example.org.?” and so on until you get your target IP.

See also https://en.wikipedia.org/wiki/Domain_Name_System#Address_resolution_mechanism

Edit: there is also a good explaination on https://docs.pi-hole.net/guides/dns/unbound/#what-does-this-guide-provide

Wireguard is very lightweight and it just works. No overly complex setup, tools, matching protocols, algorithms, versions, etc. It just works and it's simple UDP traffic. It's the first self hosted VPN that I actually love and that works on all my machines, mobiles, VMs with just a config file to fine tune what should go over the line.

Iam running it a raspberry 3b its doing fine we are with 3 ppl in house so there are not that many request

No the one you asked, but I'm running pihole on a lenovo M93 (fedora server) with 8Gb of ram. No kill like overkill, I guess.

The only time any of the cpu cores pops above 1% is when I'm updating the config, and at the moment it is hovering at 293 MB of RAM used according to the free command.

I do find that to be the case. Also some ADs just can’t seem to get filtered by DNS blockers…. DNS blocker still helps for devices that can’t have their own AD blocker though.

Hmmm...I've never noticed any lag on my end, but then again, I don't time my DNS ms resolutions myself. :) Good to know though!

Well it's a service I'm paying for, so yes a bit of trust is required. Their privacy policy looks decent as well. As it stands, I trust them more with it than I would my ISP, Google or Microsoft.

You can choose what region to log to (I chose Switzerland) and you can also configure the retention period.

https://nextdns.io/privacy

My main issue with PiHole was that the container wouldn't work on later versions of Ubuntu for some reason (if I remember correctly, anything later than 18.04). I never did figure it out. The other reason was since I was running it in Kubernetes, the whole point is to have multiple replicas running for redundancy, but PiHole's UI is coupled with its backend DNS service so if you have 3 PiHole instances running, you had 3 GUI instances as well. You could load balance the DNS requests (I used MetalLB), but visiting the UI was pointless. Also, the config was very scripty and not really container friendly - I mean it worked but it wasn't designed as a cloud native application. No fault of its own but it didn't really suit the way I like to do things.

Enter Blocky, which doesn't have a UI and has a very simple YAML config that is easily mounted to a container. It scaled much easier, used way less resources and was just simpler to manage. It was really exactly what I was looking for.

However, ultimately running the DNS service for my house out of a Pi cluster wasn't really my best idea. It has to work 100% of the time, and I would have frequent outages. We are a family of 5, so imagine lots of 'Dad! The TV's not working!!' and stuff like that every time. This thing was a pet project, and I didn't have it set up as a 'production' service, which is what it really should be. Sometimes the metallb pods would fall over, or the kubernetes TLS certificates would expire for the cluster, etc. I didn't have proper monitoring and alerting setup, etc. I just couldn't be bothered putting the effort into it that it required.

NextDNS does exactly the same thing, with probably even better controls, is more reliable, has great logging and costs bugger all.

EDIT: meant to add, I used it for more than just adblocking, but also for parental controls. NextDNS is great for that as well.

It’s not just about trusting the code (which anyway isn’t a small task to review it, and all future PRs, and run your own builds from reviewed code) but also there are some people who will avoid Russian developed stuff at the moment for moral reasons, you know, because of the whole Ukraine thing.