Turns out you need NetworkManager to connect to the network, oops.

Also clean up some Terraform things.

diff --git a/.terraform.lock.hcl b/.terraform.lock.hcl
index af14f15..3110d72 100644
--- a/.terraform.lock.hcl
+++ b/.terraform.lock.hcl
@@ -3,7 +3,7 @@
 
 provider "registry.terraform.io/dnsimple/dnsimple" {
   version     = "1.10.0"
-  constraints = "1.10.0"
+  constraints = "~> 1.10"
   hashes = [
     "h1:UOCA/dFp2ORSVi/WlCCZrjjfXPUy9vpgk4PEBv6h4w0=",
     "zh:025dbad287c9a9ca61b84fc4a14d3f595dbbc1139d5cf034597922264b756f6f",
diff --git a/main.tf b/main.tf
index 5b719e8..b6473b8 100644
--- a/main.tf
+++ b/main.tf
@@ -1,3 +1,7 @@
+# TODO
+# - [ ] migrate backend from cloud to local
+# - [ ] migrate to opentofu
+
 terraform {
   cloud {
     organization = "kejadlen"
@@ -93,10 +97,6 @@ data "tailscale_device" "mountain_of_faith" {
   hostname = "mountain-of-faith"
 }
 
-data "tailscale_device" "on_fire_within" {
-  hostname = "on-fire-within"
-}
-
 locals {
   ramble_hard      = data.linode_instances.ramble_hard.instances.0
   lotus_land_story = data.linode_instances.lotus_land_story.instances.0
@@ -116,7 +116,6 @@ resource "linode_domain" "chislan_family" {
 
 resource "pihole_dns_record" "domains" {
   for_each = {
-    "birdnetpi"        = data.tailscale_device.mountain_of_faith.addresses.0
     "git.kejadlen.dev" = data.tailscale_device.lotus_land_story.addresses.0
   }
 
diff --git a/mountain-of-faith/main.yml b/mountain-of-faith/main.yml
index d5ee43f..dec9d56 100644
--- a/mountain-of-faith/main.yml
+++ b/mountain-of-faith/main.yml
@@ -41,23 +41,19 @@
   tags: resolved
   hosts: mountain-of-faith
   become: true
-  vars_files:
-    - vars.private
   tasks:
 
-    - name: Disable NetworkManager
-      ansible.builtin.systemd:
-        name: NetworkManager
-        enabled: false
-        state: stopped
-
     - name: Configure systemd-resolved
       ansible.builtin.copy:
         dest: /etc/systemd/resolved.conf
         content: |
           [Resolve]
+          # tailscale
           DNS=100.100.100.100
           Domains={{ tailscale.tailnet_name }}.ts.net
+
+          # pihole
+          DNSStubListener=no
         mode: "0644"
       notify: restart systemd-resolved
 
@@ -130,10 +126,8 @@
 - name: Run Pi-Hole
   tags: pihole
   hosts: mountain-of-faith
-  vars_files:
-    - vars.private
   vars:
-    version: 2025.10.1
+    version: 2025.11.1
   tasks:
 
     - name: Run the Pi-Hole container