Four Meta and X tracking domains kept showing up in my phone's DNS requests. My smart TV needed a few exceptions to keep its app store working. The Android TV box had a slow launcher and preinstalled apps I couldn't remove through Settings.
What I built
I run Pi-hole in Docker on an Ubuntu mini PC. I gave the TV its own group, so its app store exceptions don't apply to my phone. Tailscale points my phone to Pi-hole on cellular and other Wi-Fi networks. I use Tailscale Serve for HTTPS access to an internal service without opening router ports. On the TV box, I used network ADB to disable unwanted apps, shorten animations, and change the launcher.
How I checked it
The Pi-hole query log showed all four target domains blocked for my phone. The launcher took more digging: Android accepted the new home setting, but the old screen kept returning. In logcat, I found a uid 0 process starting the old launcher by component name. Disabling that package stopped the override.
What didn't work
Some of the box stayed out of reach without root, like its protected system overlays. I also wanted a remote shortcut that jumps straight to a channel, but the vendor's player has no public way to tune by intent. I decompiled it to confirm, and that one's still open.
01 / REMOTEiPhoneany network
02 / LOCALSmart TVLAN
03 / LOCALAndroid TV boxLAN
04 / MANAGEMENTMac · ADB
MINI PC · DOCKERPi-holeper-device DNS rulesTailscale Servetailnet HTTPS