Document encrypted DNS for clients and the HTTP/2 and HTTP/3 web server

[DL6ER]

Documentation for the inbound DoT/DoH/DoQ server and for the HTTP/2 and HTTP/3 support of FTL's web server.

Related FTL PRs:

• Add DNS-over-QUIC (RFC 9250) up- and downstream FTL#3000 - DNS-over-QUIC (RFC 9250) up- and downstream, building on the inbound DoT/DoH server from Add inbound DoT/DoH server for clients -> Pi-hole FTL#2989
• dotdoh: make the inbound DoT and DoQ listener ports configurable FTL#3012 - makes the inbound DoT and DoQ listener ports configurable (dns.dot/dns.doq become port numbers, default 853, 0 disables)

This is a draft on purpose. It already describes the final state, i.e., the ports as numbers rather than the booleans currently in development, but docs.pi-hole.net serves master directly, so merging is publishing: these pages must not go live before the features ship. This PR is therefore to be merged with the release of v7.0, not when pi-hole/FTL#3012 lands in development.

New page docs/ftldns/encrypted-dns.md ("Encrypted DNS" in the FTLDNS menu):

1. What is served where - DoT (RFC 7858) on TCP 853, DoQ (RFC 9250) on UDP 853, and DoH (RFC 8484) at /dns-query on every TLS-enabled webserver.port. DoT and DoQ share the port number without colliding; DoH has no port of its own and follows the web server.
2. That all three are enabled by default, use the same certificate as the web interface, and that the ports are configurable - with the recommendation to stay on 853, as that is what clients try first.
3. That access is governed by dns.listeningMode, plus a warning against exposing the resolver to the Internet.
4. Test commands (kdig +tls, kdig +quic, curl) and where to enter this on Android, Apple devices, Firefox and routers.
5. That plaintext /dns-query is refused with 426 Upgrade Required instead of silently resolving.

Changes to existing pages:

1. docs/ftldns/webserver.md - a section on HTTP/2 and HTTP/3: negotiated through ALPN with nothing to configure, CivetWeb still serving HTTP/1.1 behind the TLS front end, Alt-Svc advertising h3, and the practical firewall consequence that HTTP/3 needs UDP on the same port number as HTTPS.
2. docs/api/tls.md - the certificate is now also presented to DoT/DoH/DoQ clients; a section on the automatic renewal of self-generated certificates (webserver.tls.validity, renewed two days before expiry, 0 to leave an own certificate alone); and a note that TLS 1.2 is the lowest accepted version.
3. docs/main/prerequisites.md - port 853 added to the ports table, with notes that DoH rides the HTTPS ports and that HTTP/3 uses UDP on the HTTPS port number.

Still open as separate follow-ups: the docker documentation (ports and an example compose.yaml), the plaintext-DoH-behind-a-reverse-proxy option once it exists, and the per-query transport display in the query log.

[netlify]

✅ Deploy Preview for pihole-docs ready!

Name	Link
🔨 Latest commit	9430777
🔍 Latest deploy log	https://app.netlify.com/projects/pihole-docs/deploys/6a78094b82011c00087d0127
😎 Deploy Preview	https://deploy-preview-1416--pihole-docs.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
🤖 Make changes	Run an agent on this branch

---

To edit notification comments on pull requests, go to your Netlify project configuration.