I have a Pi-Hole + PiVPN (WireGuard) + CloudFlare DoH setup and it was pretty easy to do. Most of this stuff installs itself! To be honest, the real challenge was to figure out the additional measures to ensure my home devices could only use my Pi-Hole DNS. A couple of firewall rules did it in the end.

The one thing I need to find a solution for, however... a Raspberry Pi is not quite powerful enough to handle a gigabit connection. I need to look into a more powerful device to replace it with. That would also mean I can add that RPi to my miniature cluster.