Wireguard (wg-easy) with Pi-Hole + cloudflared DNS over HTTPS using docker-compose

docker-compose.yml

version: "3.8"

services:
  wg-easy:
    environment:
      # ⚠️ Change the server's hostname (clients will connect to):
      - WG_HOST=change.me.xyz
      # ⚠️ Change the Web UI Password:
      - PASSWORD=CHANGEMEPLZ
      - WG_DEFAULT_DNS=10.8.1.3
      - WG_DEFAULT_ADDRESS=10.8.0.x
    image: weejewel/wg-easy
    container_name: wg-easy
    volumes:
      - ./wg-easy:/etc/wireguard
    ports:
      - "51820:51820/udp"
      - "51821:51821/tcp"
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1
    networks:
      wg-easy:
        ipv4_address: 10.8.1.2

  pihole:
    image: pihole/pihole
    container_name: pihole
    environment:
      # ⚠️ Change the Web UI Password:
      - WEBPASSWORD=CHANGEMETOOPLZ
      - PIHOLE_DNS_=10.8.1.4#5054
    volumes:
      - './etc-pihole:/etc/pihole'
      - './etc-dnsmasq.d:/etc/dnsmasq.d'
    ports:
      - "53:53/tcp"
      - "53:53/udp"
      - "5353:80/tcp"
    restart: unless-stopped
    networks:
      wg-easy:
        ipv4_address: 10.8.1.3

  cloudflared:
    container_name: cloudflared
    image: visibilityspots/cloudflared:latest
    ports:
      - "5054:5054/tcp"
      - "5054:5054/udp"
    restart: unless-stopped
    networks:
      wg-easy:
        ipv4_address: 10.8.1.4

networks:
  wg-easy:
    ipam:
      config:
        - subnet: 10.8.1.0/24