WireHole is a Docker Compose project that combines WireGuard, Pi-hole, and Unbound to create a private VPN with ad-blocking and recursive DNS resolution. It is not a software library but an infrastructure deployment template. The stack provides a VPN server, DNS filtering through Pi-hole, and private DNS resolution via Unbound, all running in containers. The project is designed for easy deployment on a Linux server, with a focus on security (e.g., web interfaces bound to localhost, minimal container capabilities, strong password generation). It supports two VPN backends: wg-easy (with a web UI) and linuxserver/wireguard (configuration-file based). The codebase consists of shell scripts for setup, migration, and diagnostics, along with CI/CD pipelines, test suites, and detailed documentation. The project demonstrates high operational maturity with comprehensive tests, pinning of image versions, and a doctor script for troubleshooting. While it is not a reusable software library, its scripts and configuration patterns are well-crafted and could serve as templates for similar Docker Compose deployments.