feat(docker-stack): add pihole stack

README.md

@@ -21,6 +21,7 @@ docker/stacks/<service>/
 | **Immich** | Self-hosted photo and video management | Personal media library with ML features |
 | **Paperless-ngx** | Document management system with OCR | Digital document archive and search |
 | **Media Stack** | Sonarr, Radarr, Prowlarr, qBittorrent | Automated media acquisition and management |
+| **Pi-hole** | DNS sinkhole with ad blocking and dnscrypt-proxy | Network-wide ad blocking and encrypted DNS |
 | **Arch Mirror** | Local Arch Linux package repository mirror | Local package cache for faster updates |
 
 ## Deployment

docker/stacks/pihole/docker-compose.yaml

@@ -0,0 +1,37 @@
+services:
+  server:
+    image: pihole/pihole:2025.08.0
+    restart: unless-stopped
+    environment:
+      TZ: ${TZ}
+      FTLCONF_webserver_api_password: '${PIHOLE_WEBPASSWORD}'
+      FTLCONF_dns_listeningMode: all
+      FTLCONF_dns_upstreams: dnscrypt-proxy#5353
+    labels:
+      - com.centurylinklabs.watchtower.enable=false
+    volumes:
+      - ${SERVICE_DATA_ROOT_PATH}/config:/etc/pihole
+    ports:
+      - "${PIHOLE_DNS_PORT}:53/tcp"
+      - "${PIHOLE_DNS_PORT}:53/udp"
+      - "${PIHOLE_HTTP_PORT}:80/tcp"
+    cap_add:
+      - SYS_NICE
+    depends_on:
+      - dnscrypt-proxy
+    networks:
+      - pihole
+
+  dnscrypt-proxy:
+    image: klutchell/dnscrypt-proxy:latest
+    restart: unless-stopped
+    environment:
+      TZ: ${TZ}
+    volumes:
+      - ${SERVICE_DATA_ROOT_PATH}/dnscrypt/dnscrypt-proxy.toml:/config/dnscrypt-proxy.toml
+    networks:
+      - pihole
+
+networks:
+  pihole:
+    name: pihole

docker/stacks/pihole/stack.env

@@ -0,0 +1,10 @@
+# Paths
+SERVICE_DATA_ROOT_PATH=
+
+# Basic Configuration
+TZ=UTC
+
+# Pi-hole Configuration
+PIHOLE_WEBPASSWORD=
+PIHOLE_DNS_PORT=53
+PIHOLE_HTTP_PORT=80