pi-hole and coredns, multi-provider TLS upstreams with failover, using docker compose

Corefile

private {
  auto {
    directory /config/zones
  }
}

. {
  errors
  log
  prometheus
  reload

  forward . 127.0.0.1:5301 127.0.0.1:5302 127.0.0.1:5303
}

.:5301 {
  forward . tls://1.1.1.1 tls://1.0.0.1 {
    tls_servername cloudflare-dns.com
  }
}

.:5302 {
  forward . tls://9.9.9.9 tls://149.112.112.112 {
    tls_servername dns.quad9.net
  }
}

.:5303 {
  cache
  forward . tls://8.8.8.8 tls://8.8.4.4 {
    tls_servername dns.google
  }
}

docker-compose.yml

version: '3.3'
services:
  coredns:
    command: -conf /config/Corefile
    environment:
      TZ: UTC
    image: coredns/coredns
    networks:
      default:
        ipv4_address: 10.198.0.4
    volumes:
      - ./coredns:/config
    restart: unless-stopped

  server:
    dns:
      - 127.0.0.1
      - 10.198.0.4
    environment:
      DNS1: 10.198.0.4#53
      DNS2: 10.198.0.4#53
      TZ: UTC
    env_file: secrets.env
    image: pihole/pihole
    networks:
      default:
        ipv4_address: 10.198.0.3
    ports:
      - "10.50.3.5:53:53"
      - "10.50.3.5:53:53/udp"
      - "80:80"
      - "443:443"
    restart: unless-stopped
    volumes:
      - pihole_etc:/etc/pihole
      - ./dnsmasq.d:/etc/dnsmasq.d

volumes:
  pihole_etc:
  pihole_dnsmasq:

networks:
  default:
    driver: bridge
    ipam:
     config:
       - subnet: 10.198.0.0/29