[{"data":1,"prerenderedAt":116},["ShallowReactive",2],{"seo-verification":3,"blog-heberger-pi-hole-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"title":9,"excerpt":10,"readTime":11,"views":12,"isPinned":13,"publishedAt":14,"category":15,"categories":20,"featuredImage":22,"bgImage":23,"posterImage":24,"relatedSolution":25,"intro":27,"sections":28,"ctaTitle":71,"ctaBody":72,"ctaButton":73,"ctaUrl":74,"relatedPosts":75},91,"heberger-pi-hole","Hosting Pi-hole on your own VPS","Block ads and trackers across your whole network: deploy Pi-hole on a VPS as a secure DNS resolver. Self-hosting guide with DoH.",7,567,false,"2026-03-21T00:00:00+00:00",{"id":11,"name":16,"slug":17,"color":18,"icon":19},"Self-hosting","self-hosting","bg-indigo-500\u002F10 text-indigo-400","cloud",[21],{"id":11,"name":16,"slug":17,"color":18,"icon":19},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fheberger-pi-hole-poster.svg",{"categorySlug":17,"appSlug":26},"pi-hole","Pi-hole blocks advertising and tracking at the DNS level, for all your devices at once. On a Raspberry Pi, it only protects your local network; on a VPS, it becomes a DNS resolver accessible everywhere — at home, on the go, on mobile — provided you lock it down properly. Here's how to do it cleanly.",[29,33,43,46,68],{"type":30,"title":31,"body":32},"h2","Why self-host Pi-hole on a VPS","Pi-hole is a filtering DNS resolver: it intercepts your devices' requests and refuses to resolve advertising, telemetry and tracking domains based on block lists. Hosted on a VPS rather than on a Raspberry at home, it follows you everywhere: your phone on 4G, your laptop at the café, or a remote server can use it as DNS and benefit from the filtering. The VPS provides what local hardware cannot: a stable public IP accessible from anywhere and permanent availability. The trade-off is security — a DNS resolver open on the Internet is a target. That's the whole point of this deployment: to expose Pi-hole in a controlled way, never as an open public DNS.",{"type":34,"title":35,"items":36},"ul","Concrete benefits of Pi-hole on a VPS",[37,38,39,40,41,42],"Ad filtering and anti-tracking for all your devices, wherever they are, with no software to install.","Encrypted DNS possible (DNS-over-HTTPS \u002F DNS-over-TLS) upstream via a resolver such as cloudflared.","Detailed dashboard: see in real time which domains your devices are contacting.","Customizable block lists and allow\u002Fdeny rules per client for differentiated policies.","Faster resolution thanks to the local DNS cache, shared across all your devices.","Reusable as DNS for your other VPSs and containers, with centralized logging.",{"type":30,"title":44,"body":45},"Technical prerequisites","Pi-hole is extremely lightweight: 1 vCPU, 512 MB to 1 GB of RAM and a few gigabytes of disk are enough. You need Docker and Docker Compose. The critical point is not power but network and security: Pi-hole listens on port 53 (DNS, TCP and UDP) and exposes a web admin interface. Never open port 53 to the whole Internet — an open DNS resolver will be abused for amplification attacks. So plan for either a VPN (WireGuard) to access the DNS privately, or a firewall restriction to authorized IPs only. A `pihole.yourdomain.com` subdomain is useful for the interface over HTTPS.",{"type":47,"title":48,"steps":49},"steps","Deploy Pi-hole step by step",[50,53,56,59,62,65],{"title":51,"body":52},"Prepare the Docker stack","On the VPS, create `\u002Fopt\u002Fpihole` and a `docker-compose.yml` based on the `pihole\u002Fpihole:latest` image. Set the `WEBPASSWORD` variable, the `TZ` time zone, and mount volumes for `\u002Fetc\u002Fpihole` and `\u002Fetc\u002Fdnsmasq.d` to persist the configuration.",{"title":54,"body":55},"Lock down DNS access first of all","Do not publish port 53 to `0.0.0.0`. The safest approach: first deploy WireGuard on the VPS and make Pi-hole listen only on the VPN interface. Failing that, restrict port 53 by firewall (`ufw`) to trusted IPs only. An open resolver is unacceptable.",{"title":57,"body":58},"Start Pi-hole","Start with `docker compose up -d`. Check that the service responds internally: `docker compose exec pihole dig @127.0.0.1 doubleclick.net` must return a blocked response (0.0.0.0).",{"title":60,"body":61},"Secure the admin interface","Expose the web interface (internal port 80) only behind an HTTPS reverse proxy, never in the clear. With Caddy: `pihole.yourdomain.com { reverse_proxy pihole:80 }`. The admin remains accessible at `\u002Fadmin` with the password you set.",{"title":63,"body":64},"Enable an encrypted upstream DNS","Add a `cloudflared` container as a DoH resolver and configure Pi-hole to use it as upstream (`127.0.0.1#5053`). Your outbound requests are then encrypted between the VPS and the public resolver.",{"title":66,"body":67},"Configure your devices","Point your devices' DNS (or the WireGuard config) to the VPS's IP. On mobile, use the VPN profile to route DNS through Pi-hole even on the go. Check the filtering in the real-time dashboard.",{"type":69,"body":70},"tip","Combine Pi-hole with WireGuard on the same VPS: make Pi-hole listen exclusively on the `wg0` interface and distribute it as DNS in the WireGuard peers' configuration. You get a private, encrypted, filtering DNS accessible from anywhere, without ever exposing port 53 to the Internet — it's the only truly safe way to have a “roaming” Pi-hole. Then add themed block lists (for example anti-telemetry or regional anti-tracker lists) rather than a single giant list, to keep the false-positive rate low.","A filtering DNS that follows you everywhere","The ServOrbit Cloud VPS, with its stable public IP, hosts a ready-to-lock-down Pi-hole + WireGuard template: block ads and trackers on all your devices, even on the go, without ever exposing an open resolver.","Deploy on Cloud VPS","\u002Fvps-cloud",[76,89,103],{"id":77,"slug":78,"title":79,"excerpt":80,"readTime":11,"views":81,"isPinned":13,"publishedAt":82,"category":83,"categories":84,"featuredImage":22,"bgImage":23,"posterImage":86,"relatedSolution":87},71,"heberger-nextcloud","Hosting Nextcloud on your own VPS","Take back control of your files: deploy Nextcloud on your VPS with Docker, database, reverse proxy and SSL.",2720,"2026-04-10T00:00:00+00:00",{"id":11,"name":16,"slug":17,"color":18,"icon":19},[85],{"id":11,"name":16,"slug":17,"color":18,"icon":19},"\u002Fblog\u002Fcovers\u002Fheberger-nextcloud-poster.svg",{"categorySlug":17,"appSlug":88},"nextcloud",{"id":90,"slug":91,"title":92,"excerpt":93,"readTime":94,"views":95,"isPinned":13,"publishedAt":96,"category":97,"categories":98,"featuredImage":22,"bgImage":23,"posterImage":100,"relatedSolution":101},72,"heberger-ghost","Hosting Ghost on your own VPS","Launch a professional blog or newsletter with Ghost on your VPS: Docker, database, paid subscriptions, reverse proxy and SSL.",6,2000,"2026-04-09T00:00:00+00:00",{"id":11,"name":16,"slug":17,"color":18,"icon":19},[99],{"id":11,"name":16,"slug":17,"color":18,"icon":19},"\u002Fblog\u002Fcovers\u002Fheberger-ghost-poster.svg",{"categorySlug":17,"appSlug":102},"ghost",{"id":104,"slug":105,"title":106,"excerpt":107,"readTime":11,"views":108,"isPinned":13,"publishedAt":109,"category":110,"categories":111,"featuredImage":22,"bgImage":23,"posterImage":113,"relatedSolution":114},73,"heberger-wordpress","Host WordPress on your own VPS","Host WordPress on your VPS for maximum performance and control: Docker, MariaDB, caching, reverse proxy and SSL.",501,"2026-04-08T00:00:00+00:00",{"id":11,"name":16,"slug":17,"color":18,"icon":19},[112],{"id":11,"name":16,"slug":17,"color":18,"icon":19},"\u002Fblog\u002Fcovers\u002Fheberger-wordpress-poster.svg",{"categorySlug":17,"appSlug":115},"wordpress",1785628445008]