If you don't get any other answers:

I run OpenWRT on my router (x86 hardware), and have Adguard Home and Wireguard installed on it.

AdGuard has its own webUI, and Wireguard peers can be managed through LuCI in OpenWRT. It also supports OpenVPN as well as other VPN types.

So you could run a VM with OpenWRT and get all that.

@damnthefilibuster
For Android I recommend Rethink
It has Wireguard, DNS and Firewall (per app and per IP/Domain)

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

4 acronyms in this thread; the most compressed thread commented on today has 14 acronyms.

[Thread #816 for this sub, first seen 18th Jun 2024, 20:45] [FAQ] [Full list] [Contact] [Source code]

I run a VPS with its own DNS resolver (to load blocklists), then it tunnels the traffic down a multi-hop VPN and it’s pretty excellent.

you can just set your pihole as the dns server for all your wireguard clients i guess

This runs a combination of both. Been using this for years and works like magic

Maybe not a docker solution, but you could throw pfSense into a VM and do all that from there

I use it (as it's intended) as my firewall, but I used to use these as general purpose network security VMs in the past (just because I know the product well)

So for you: no firewall rules, just setup DNS with pfBlocker (for the advert blocking) and setup the VPN as required...

Just an idea...

Check out WireHole or openvpn-pihole

I know some VPN providers have their own DNS service that you can use similar to other filtered public DNS. If you mean an in house DNS/VPN gateway then what you want is probably best served by something like a firewall distro (opnsense/pfsense) to handle both of them.

There are "public" pihole servers: use their dns, or the many other ad-blocking servers out there as the dns for your VPN.

Tbh, I've stopped the selfhosted vpn route and use tailscale (which can be selfhosted/has a docker image). It doesn't get simpler.

You might look at gluetun. It lets you configure various VPN services from a docker container. The interesting part is that you can point other docker containers to utilize gluetun for networking. Essentially piping them through the configured VPN.

Not self hosted, but I've been using tailscale with nextdns and it has been very reliable. I got tired of worrying about availability of hosting my own

In this same subject, is there a way to set up pihole as DoT or at least DoH? Full disclosure, I have not done any research on this. The thought just came up while reading this thread.

Adguard? Although I don't know if they have a firewall based Killswitch so it might be vulnerable to tunnel vision if it's not being used in a VPN router

You might need to replace your pi-hole with adguard home to make it work