Pi-hole is good, as is simply running BIND, but I have to strongly recommend against DNS-over-HTTPS (DoH).
First, who says that Cloudflare is trustworthy? They want us to trust them, but they do a lot of underhanded things.
Second, if more individual programs, like Firefox, start using DoH...