Generate production-ready Docker configurations for AdGuard Home and Pi-hole with SSL, DoH/DoT, and per-client IP? visibility.
Added Nov 28, 2025
Self-hosters struggle to properly secure AdGuard Home/Pi-hole with SSL certificates and encrypted DNS protocols while maintaining visibility into individual Docker container DNS requests. Manual configuration requires deep Docker networking knowledge and complex reverse proxy setup, often resulting in security gaps and loss of per-client analytics.
A CLI/web tool that automatically generates Docker Compose files with integrated nginx proxy for SSL termination, Let's Encrypt/mkcert integration, and macvlan/ipvlan networking to preserve client IPs?. Users answer a few questions and receive a complete, production-ready configuration that reduces deployment time from hours to minutes.
The surge in self-hosting and privacy-focused DNS solutions has outpaced tooling; existing solutions require manual configuration of multiple complex components, creating friction for the rapidly growing homelab community seeking turnkey security.
Showing 1-2 of 2 signals
Hello everyone! It's a couple of days that I'm trying to find a solution to this dilemma and in the end I opted to ask directly to someone more expert than me. My problem is that I'm using AdGuard Home as my DNS resolver, exposing port 53 in the local network and setting my Lan DNS as ip_docker_host. This works fine, every device in my network resolve correctly and I can block all spam/ads domains. In my /etc/docker/daemon.json I set the DNS the same as my router, so also in the containers the name resolution works fine. My problem is that I see the requests of each container as coming from the same IP (my docker network bridge). From what I understood it is because the default docker network bridge automatically mask the ip of the container making the request and put its ip in his place. Is there any way to circumvent this problem to allow adguard to see each container from their internal ip? So that I can for example see as separate clients the requests coming from qBittorrent and from Firefox. I _think_ that by putting all the containers in the same network with adguard, it could directly see the requests as separate clients because they talk directly without passing from the default bridge, right? The problem I see with this method is that each container could talk to each other, and for safety reason I'm not at ease with this idea. Is there any way to allow each container to talk freely to a specific central container, but not to talk to each other? Thanks for all the help you can give me!
Go beyond the grade and inspect the evidence behind this opportunity.
Reddit discussions
See the original problems, requests, and conversations.