How I turned two of the four Pis into a redundant DNS pair — Pi-hole blocking ads, Unbound recursing directly to root servers, zero ISP resolver seeing my queries. Plus the rolling upgrade playbook that gates each Pi behind a dig health check so the house never loses DNS.
$ grep -l "#Unbound" /blog/*.mdx // 1 match