0xERR0R/blocky ? reverse-engineered prompt

Build me a small self hosted DNS blocker for my home network that runs as a single Go service and can act like a local DNS proxy.

I want it to block ads and malware using external blocklists, let me add allowlists and denylists, and give me different rules for different devices or groups like kids and smart home devices. It should support normal DNS plus secure options like DNS over HTTPS, TLS, and QUIC, and be able to forward some domains to specific upstream resolvers. I also want caching so lookups feel fast, plus logs, metrics, and a simple REST API so I can see what is being blocked and query stats later. Use a simple YAML config, keep it lightweight and stateless, and make it easy to run in Docker on something like a Raspberry Pi or home server. If you need to look up current docs online, go ahead.