Pi-hole Without the Pi
Network-wide ad and tracker blocking, on a server you never have to touch.
DNS for your network, not the whole internet.
So port 53 answers only the networks you list.
us.kheeper.com/public/pihole
- Pi-hole, blocking ads and trackers for every device that uses it
- Caddy, with automatic TLS on the admin UI
- A firewall that opens DNS only to your CIDRs — never an open resolver
- Cloudflare and Quad9 upstream by default, or your own
Blocking ads shouldn't mean babysitting a board.
Or handing your DNS history to a subscription.
Until the SD card dies
It works at home, then the card wears out, an update breaks it, or the power blinks — and the whole house loses DNS.
Per month, someone else's logs
Convenient, but every lookup your devices make lands on someone else's servers, and the subscription never ends.
One box, yours
A server in the cloud or a rack, booted from one image and upgraded by releasing another. Your query log stays on your host.
Questions
Can I use it away from home?
Yes, from any network you list in dns_allowed_cidrs — an office, a VPN subnet or your home IP. Everything else is dropped by the host firewall.
Why not leave DNS open?
An open resolver gets abused for amplification attacks within hours. The image requires at least one allowed network and refuses everyone else.
Which upstream resolvers does it use?
Cloudflare (1.1.1.1) and Quad9 (9.9.9.9) unless you set upstream_dns to your own.
How do I reach the admin UI?
Over HTTPS on the domain you configure, with a Let's Encrypt certificate Caddy issues and renews. Each host also gets a name under kheeper.app you can use.