Network-wide ad blocking

Two Raspberry Pis run Pi-hole with Unbound as a recursive resolver, load balanced with Keepalived so DNS keeps working even if one node goes down.