lj·rk @WHY2025<p>Thinking about my (still WIP) <a href="https://todon.eu/tags/PiHole" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>PiHole</span></a> setup. AFAICT, the guide for <a href="https://todon.eu/tags/DoH" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DoH</span></a> with <a href="https://todon.eu/tags/cloudflared" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>cloudflared</span></a> at <a href="https://docs.pi-hole.net/guides/dns/cloudflared/" rel="nofollow noopener" target="_blank"><span class="invisible">https://</span><span class="ellipsis">docs.pi-hole.net/guides/dns/cl</span><span class="invisible">oudflared/</span></a> only coveres using DoH between the PiHole and the upstream DNS provider (e.g., Cloudflare, Google, etc.). But if I want to use DoH between my browser and my PiHole, I seem to need another DoH Proxy, which makes request flow like this:</p><p>1. incoming on dns.ljrk.org:443 (traefik reverse proxy)<br>2. forwarded to 127.0.0.1:80 (DoH Proxy #1)<br>3. upstream classic DNS resolver on 127.0.0.1:53 (PiHole)<br>4. forwards any non-blocked requests to 127.0.0.1:5053 (DoH Proxy #2)<br>5. upstream DoH DNS resolver such as 1.1.1.1:443/dns-request</p><p>Of course, most PiHole setups are local and I'll probably end up opening dns.ljrk.org only through a <a href="https://todon.eu/tags/TailScale" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>TailScale</span></a>/#HeadScale <a href="https://todon.eu/tags/VPN" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>VPN</span></a>, but my browser may still prefer to speak DoH instead of RFC1035. I'm also not sure how <a href="https://todon.eu/tags/DNSSEC" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>DNSSEC</span></a> plays into this...</p>