The tools I used and will describe are:

VPS – in this case, I used a basic Hetzner Cloud VPS, but any provider that provides IPv6 connectivity will do – if you want IPv6, of course.
FreeBSD – a versatile, stable, and secure operating system.
Wireguard – lightweight, secure, and at the same time, not very “chatty,” so it is also gentle on mobile device batteries. When there is no traffic, it simply does not transmit/receive anything. Well supported by all major desktop and server operating systems as well as Android and iOS devices.
Unbound – can make DNS queries directly to root servers, not through forwarders. It also allows you to insert block-lists and have a result similar to that of Pi-Hole (i.e., ad-blocking).
SpamHaus lists – to immediately stop connections to and from users on blacklists.