Introduction

elele. DNS is a self-hosted analytics front end for AdGuard Home or Pi-hole. It reads the query log continuously into a store of its own, keeps ninety days of it, and turns the result into the thing the log was always describing: which devices in your house are talking, to whom, where those companies are, and what your filtering is actually costing anybody.

The gap it fills#

AdGuard HomePi-hole’s API returns far more per-query data than its own interface ever shows. Every entry carries the resolution time, the upstream that answered, whether it came from cache, the rule that matched, and the full answer section with resolved addresses and the reply type. Almost none of that reaches a screen.

The constraint underneath is smaller and harder: the query log is a circular buffer sized in entries. On a household doing tens of thousands of lookups a day it holds a few hours and then begins overwriting itself. Nothing downstream can be more complete than its source, so the first thing this product does is stop throwing it away.

Everything else follows from that. Ninety days of history is what makes “first seen this week” meaningful, what lets a device’s rhythm be drawn by hour of the week, and what turns a blocked count into an answer about whether the blocking annoyed anybody. See why history is the whole argument.

What it is not#

• Not a resolver. AdGuard HomePi-hole answers DNS. This reads its log. If you switch this off, the network carries on resolving exactly as before.
• Not a replacement for AdGuard HomePi-hole’s settings. It can change a few of them, through AdGuard HomePi-hole’s own API, behind confirmations that state the blast radius first — nine screensone screen, because Pi-hole’s API exposes far less of itself. The filtering engine, the rule syntax and the upstream handling all remain AdGuardPi-hole’s.
• Not multi-tenant. One install serves one household. There are no accounts, no roles, and no login at all.
• Not a cloud service. Nothing leaves the box. The enrichment datasets are downloaded once and consulted locally; no query, domain or address is ever sent anywhere.

The shape of it#

Four moving parts. A poller that walks the resolver’s log backwards, a SQLite store, a rollup pass that keeps aggregates alive after detail is pruned, and a Next.js app that only ever reads.

Architecture covers each part properly, and Ingest covers the awkward bit: turning a buffer that overwrites itself into a history with no gaps and no duplicates.

Where to start#