You don’t need DHCP, you can just use DNS and then set up different blocking groups based on the device.

The problem with this solution is that is it opt in. You would need to change all the wifi settings on each device separately to point to Pi-Hole as the DNS. This is something that could easily be disabled as a 12 year old would probably be able to figure out how to change the settings on their mobile devices or computer with a Google search.

I don’t host my media outside my local network but, if I did, I would use my go to method of SWAG with Authentik. This is what I have done for my other self-hosted items.

• Calibreweb
• FreshRSS
• Grampsweb
• Emacs
• Gitea
• Stirling-PDF
• Vaultwarden
• Pihole
• Pyload
• Glances
• Syncthing
• Homepage
• Karakeep