# IAmStoxe/wirehole

WireHole is a combination of WireGuard, Pi-hole, and Unbound in a docker-compose project with the intent of enabling users to quickly and easily create a personally managed full or split-tunnel WireGuard VPN with ad blocking capabilities thanks to Pi-hole, and DNS caching, additional privacy options, and upstream providers via Unbound.

Repository: https://github.com/IAmStoxe/wirehole
Canonical: https://ross.abutalabs.com/products/wirehole
Homepage: https://iamstoxe.com
Language: Shell
License: NOASSERTION
License Family: other
Topics: pihole, wireguard, docker, adblock, dns, vpn, ad-blocking, unbound, pi-hole, dns-provider
Last push: 2026-08-25T03:05:23+00:00

## Health v2 (maintenance only)
Score: 77/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 99, release rhythm 35, longevity 100
- inputs: {"age_days": 2190, "days_push": 8, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: no_releases, no_license
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 4968, forks 342 (observed 2026-08-28T04:09:04.003418+00:00)

## What it is
WireHole is a docker-compose project that combines WireGuard, Pi-hole, and Unbound into a single self-hosted VPN stack. It provides a personal full or split-tunnel VPN with network-wide ad blocking, private recursive DNS resolution, and DNSSEC validation.

## Use cases
- set up my own wireguard vpn server with ad blocking
- self-host a vpn with pihole and unbound
- block ads on all devices through a vpn tunnel
- run a private dns resolver instead of google or cloudflare
- deploy a split tunnel vpn with docker compose
- encrypt my traffic on public wifi with my own server
- get dnssec validating dns for my vpn clients

## When to choose
- you want a personal VPN you fully control instead of a commercial provider
- you want network-wide ad and tracker blocking for every connected device
- you want DNS queries resolved directly by authoritative servers with DNSSEC validation
- you want a quick, pre-configured docker-compose deployment of WireGuard, Pi-hole, and Unbound

## When to avoid
- you need a managed VPN with many server locations and no server maintenance
- you cannot open ports or run a publicly reachable server
- you need obfuscation to evade deep packet inspection or censorship, which plain WireGuard does not provide
- you want a one-click consumer product rather than a self-managed stack

## Facets
- artifact type: infra-config
- maturity: active
- function: vpn, caching, security, self-hosted, networking, deployment
- domain: networking, privacy, self-hosted, security
- platform: self-hosted, cloud
- tags: wireguard, pi-hole, unbound, ad-blocking, dns, docker-compose, split-tunnel, dnssec, devops, docker, linux

## Member repositories
- IAmStoxe/wirehole (main) score 77

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:04.003418+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T18:17:45.853138+00:00, confidence not recorded.
  - readme: https://github.com/IAmStoxe/wirehole (fetched 2026-08-28T04:09:04.003418+00:00, sha b7218dea0d5d)
  - homepage: https://iamstoxe.com (fetched 2026-08-29T08:59:02.950852+00:00, sha b1011b0513bb)
- Data as of 2026-08-30T08:39:29.467469+00:00.