1. Use a VPS.
2. A write-up please. This is beyond my current understanding of Docker networking and more resources would really help

You can access it from any device (assuming relevant client apps and its over the network)

There have been reports of OpenVPN traffic being discovered as VPN traffic even after using obfuscation with obfs-proxy. I believe SSL VPNs are coming out for the self-hoster, and I’m personally very interested in SoftEther

I plan to use podman at home since I just have one node and I don’t care about HA as much (what will I even do HA with? VMs?).

If you have multiple nodes for an HA setup, sure, go right ahead. It will be a massive learning curve though. But so are most things in life. I think everyone can learn a lot by running kubernetes (godly complex networking in my opinion).

assumed PiHole was proprietary

Did it look proprietary on their website?

Personally, I wouldn’t even run bind in my homelab. I don’t see the point. dnsmasq is good enough for me. But if you’d like to run it, go ahead!

Creating a new TLD for a VPN with an authoritative DNS for your local network isn’t the hardest thing, I’m sure you’ll find documentation on how to do so BIND’s website. If you don’t understand something just ask your search engine or ChatGPT/Bing (do not rely on LLMs for factual information, but they’re good at summarising information, from Wikipedia for example). Maybe get in the habit to RTFM, it does help.

BTW here’s a good list of internal TLDs one might want to use: https://serverfault.com/questions/17255/top-level-domain-domain-suffix-for-private-network

Do you have a purpose to host whatever you happened to name here?

There is a reason to host reverse-proxies, however, one can do without them in a self-hosted environments. First, one needs to understand the point behind reverse-proxies (this is an example btw, you might very well know the how and why behind them), and only then would the instructions to set it up start to make sense.

I came across monit recently, seems nice