Migrating from Pi-hole to a High-Availability Technitium DNS Cluster with Local DoH & Pure Recursion
Hello fellow homelabbers, After recently migrating my homelab DNS infrastructure from Pi-hole to a High-Availability Technitium DNS Cluster, I wanted to share my architecture, findings, and performance testing results with the community. When designing a homelab DNS setup, you face multiple implementation choices. Because I am running my two DNS instances on significantly different generations of hardware, finding the optimal configuration required some real-world benchmarking.The Hardware & Topology. My Proxmox environment utilizes two distinct physical hosts:Lenovo ThinkStation P520 – Running an Intel Xeon W-2135 CPU (released in 2017).Aoostar WTR Pro Max – Running an AMD Ryzen 7 8845HS CPU (released in 2024).The 2024 Ryzen CPU is substantially more powerful than the 2017 Xeon. To optimize performance based on this hardware asymmetry, I configured my router's DHCP scope to lease the Aoostar instance (192.168.11.51) as the Primary DNS server, and the Lenovo instance (192.168.11.50) as the Secondary DNS server. This ensures the bulk of the network load is handled by the faster CPU, while the older hardware stands by as a seamless failover node. Both servers stay perfectly synchronized using the built-in Technitium Cluster Sync application. The Architecture: Solving the Encryption vs. Autonomy Paradox.My goal was absolute privacy inside my network, combined with complete independence from upstream public DNS providers (like Cloudflare, Google, or Quad9). Achieving this requires balancing two distinct traffic directions:Inbound (Client to Homelab): DNS-over-HTTPS (DoH)To secure local network traffic, I deployed Nginx Proxy Manager (NPM) inside my Docker environment. NPM handles the incoming HTTPS connections on port 443 using a valid Let's Encrypt Wildcard Certificate. To prevent complex Nginx database and SSL handshake issues (ERR_SSL_UNRECOGNIZED_NAME_ALERT), I kept NPM clean. I created two straightforward Proxy Hosts (dns1.patad.nl and dns2.patad.nl) that route traffic on the backend directly to the Technitium LXC containers on a custom DNS-over-HTTP port (8053).To make this accessible locally without routing traffic out to the internet, I configured a Split-Horizon DNS zone within Technitium for (my domainname), pointing dns1 and dns2 directly to NPM's local IP address.