NetGuard is on-device, can't get much more 'self-hosted' than that. Can PiHole filter per-app though? I wouldn't have thought so. NG can and it's the main reason I use it.