- services/pihole.nix: DNS adblock + DHCP, upstream unbound, .sol domain, jupiter static lease 00:e0:4c:3c:a3:1f -> 10.0.0.20 (declarative!) - drop services/adguardhome.nix; mercury imports pihole - admin password set via 'pihole setpassword' post-boot (not in repo)