That might explain the problem. Assuming adguard returns an nxdomain for blocked sites then the devices will try with their secondary DNS server and get to the blocked site

Sorry I misread your post. You shouldn’t need the 172 address in your DNS config, stick to the 127 address only.

In regard to the issue itself. Do your devices show their DNS server as the adguard server?

Your adguard config looks strange. The examples shown list different DNS providers but you have pointed it back at itself for its DNS. I don’t understand why you would do that.

I have a similar setup using Truenas to store data. I’ve setup a VM in Truenas that can access the data via NFS (easier to setup on Linux than SMB).

It’s nice to keep all your services contained in one machine, as long as it has enough resources, and will probably consume less power than running another PC.

I use qbittorrent, most people seem to agree it performs better than Transmission. It’s accessible from a web interface.

I just tried adding a native VPN and there’s no option to use Wireguard

Pinhole has allowed custom local records for a very long time now