dnsproxy-config VS dnsproxy

Yes.

You can find the project here, the documentation describes installation alongside or in front of Pi-hole, depending on the use case. If you want secure incoming traffic, a certified FQDN is required. This is left as an exercise for the user (to raise the bar somewhat).

No need for the full AGH stack. You can easily run dnsproxy alongside or in front of Pi-hole.

I still need to fix up a couple of permission issues in my documentation, but I have the rough outline of deploying dnsproxy as a standalone simple service here. The last few edits I made to it were getting it to use the yaml syntaxed config file, and trying to make sure a default configuration should Just Work without having to edit it, but you'd still want to.

It's very possible. You could easily set this up yourself. I do so so myself using dnsproxy, and you could too.

I have an example dnsproxy service here that I use for high availability (one-to-many) distribution and providing encrypted transport.

You might know me as that Unbound guy, or maybe even that dnsproxy guy. Today I would like to make myself known as that Munin guy, and introduce munin-pihole-plugins for Munin Monitoring.

Take a look at dnsproxy. I have an example deploying it as a simple service distribution proxy here that you could build off.

Sort of.

Which OS is this? In Android the Private DNS (DoT) setting is respected by some clients like the standard WireGuard & OpenVPN, so you can just load any provider's config and enter your personal DoT address. In iOS Passepartout can accept WG/OpenVPN config and apply custom DoH, as for desktop OS you can just run https://github.com/AdguardTeam/dnsproxy forwarding to your DoH/DoQ address and set the VPN interface to use localhost as DNS.

Since nextdns-cli isn't likely to support DoQ anytime soon, your best bet is dnsproxy and ctrld.

The easiest way would be to run AdGuard Home or https://github.com/AdguardTeam/dnsproxy on your router.

I came away with it with the major takeaway that you'd probably be much better off here using a proxy that's already pretty thoroughly torture tested and has greater flexibility. I use dnsproxy for a similar purpose to yourself. If you have any queries about standing it up as a service alone you're free to give me a yell. It accepts runtime arguments, and can parse .yaml config. You'd possibly know it better as "the guts of AdGuard".

I use dnsproxy for a similar purpose to yourself.

Full documentation can be found at AdGuard's dnsproxy master repository.

No need to run the entire project. You can still run Pi-hole, and put dnsproxy in front. That's the guts of AdGuard, essentially. Which itself is mostly a compilation of cobbled together existing Go libraries.

If you own your own domain or don't mind spending a few bucks, and want to get your hands dirty and have a go at breaking the Internet, I very highly recommend AdGuard Team's dnsproxy as a very fast, lightweight, standards compliant nameserver proxy.