pihole-docker-compose.yml

version: "3.4"

# More info at https://github.com/pi-hole/docker-pi-hole/ and https://docs.pi-hole.net/
services:
  pihole:
    container_name: pihole
    image: pihole/pihole:latest
    ports:
      - "10.42.0.0:53:53/tcp"
      - "10.42.0.0:53:53/udp"
      # - "10.42.0.0:67:67/udp" Not needed as IPs are handled by Wireguard setup
      - "10.42.0.0:80:80/tcp"
    environment:
      TZ: 'America/Chicago'
      # WEBPASSWORD: 'set a secure password here or it will be random'
    # Volumes store your data between container upgrades
    volumes:
      - './etc-pihole/:/etc/pihole/'
      - './etc-dnsmasq.d/:/etc/dnsmasq.d/'
    # Recommended but not required (DHCP needs NET_ADMIN)
    #   https://github.com/pi-hole/docker-pi-hole#note-on-capabilities
    cap_add:
      - NET_ADMIN
    network_mode: host
    restart: unless-stopped

Required prerouting nftables rules:

iif wg0 ip saddr 10.42.0.5 udp dport { 53 } counter dnat to 10.42.0.0:53;
iif wg0 ip saddr 10.42.0.5 tcp dport { 53 } counter dnat to 10.42.0.0:53;