This repository is Mullvad's DNS blocklist generation pipeline, implemented primarily as an Ansible playbook that ingests upstream blocklists from public URLs (oisd, hagezi, Firebog, AdGuard, URLhaus, etc.), combines them with category-specific custom lists, and emits normalized blocklist artifacts in plain-text and BIND RPZ zonefile formats. The output is split into `relay` (for VPN servers) and `doh` (for encrypted DNS servers) variants, with GPG signatures attached to relay files for integrity verification. Although the repo is structured like infrastructure-as-code, it functions as a data pipeline: raw data enters, transformations are applied via Ansible tasks, and ready-to-consume DNS-blocking datasets are produced and committed back to the repository. The core transformation flow is contained in `playbook.yml`: download sources into a temporary directory, normalize line endings, strip IP literals and comment syntax, concatenate files by category, remove excluded domains (e.g., mullvad.net), and generate zonefiles with a Jinja2 template that are validated with `named-checkzone`. Social media blocklists are produced separately using a shell script that runs `subfinder` in parallel over known social domains and a Python script that converts ASNs (Facebook, TikTok, Snapchat) into RPZ-style IP subnets. The repository also includes a CI workflow that runs a zone-data validation script on every push. This is a hybrid of data pipeline and DevOps automation rather than a conventional software application. It has no API endpoints or user-facing runtime; its "users" are Mullvad's own DNS servers and VPN relays. The engineering is pragmatic and effective, with a focus on maintainability of the lists themselves rather than abstract software design. A notable caveat is that Mullvad's public encrypted DNS service is scheduled for shutdown in November 2026, which may reduce the long-term relevance of the DoH output, though the VPN relay blocking pipeline remains active.