My simple solution involves running it on Fly.io to make it easy to relocate anywhere, and embedding tailscale into the same firecracker VM (né docker container) to keep the infra dead simple and cheap.

Naively deploying a publicly accessible DNS resolver is not ideal[^2] so the main constraint was to secure the VM by 1) keeping all public ports closed and 2) having Pi-hole listen only on the private network interface created by TailScale.

It's all very straightforward but it's noticeably improved my bandwidth usage and page loading times across my laptop and mobile phone, so I figured I'd share. Suggestions for improvement are also welcome!

[^1]: https://twitter.com/QuinnyPig/status/1558521941538983936

[^2]: https://www.cloudflare.com/learning/ddos/dns-amplification-d...