Merge pull request 'fix(vpn): enrol keith-phone-home and admit the WireGuard subnet to PiHole DNS' (#158) from fix/wg-home-peer-pihole-sources into main

Reviewed-on: #158

catalog/pihole.yaml

@@ -85,7 +85,7 @@ env:
   # Default is LOCAL, which answers only clients on the same subnet as the listening interface. The
   # pod's interface is on the CLUSTER pod CIDR, so every LAN client would be refused. ALL is
   # required for a LoadBalancer-fronted resolver; what keeps PiHole from being an OPEN resolver is
-  # the exposure, not this setting — `loadBalancerSourceRanges: [${LAN_CIDR}]` on the DNS Services,
+  # the exposure, not this setting — `loadBalancerSourceRanges: [${LAN_CIDR}, ${WG_CLIENT_CIDR}]` on the DNS Services,
   # enforced by Cilium in the datapath before load-balancing, plus a CiliumNetworkPolicy that admits
   # nothing but udp/53 and tcp/53. See apps/wave-0/pihole-dns.yaml.
   - name: FTLCONF_dns_listeningMode