A self-hosted Docker stack combining WireGuard, Pi-hole, and Unbound for a private VPN with ad blocking and secure DNS.