So what services are pictured here?
I see:

• Messaging: Signal & Matrix
• OpenWRT & something?
• Search: SearchXNG
• OS: Linux
• Downloads: Qbittorrent
• Fediverse, to connect them all

“My potions are TOO strong for you, traveller!”

True, I just found it convenient to block ads and trackers on a system level.

If you are using something like nextDNS it’s very easy to block ads and trackers everywhere, and even block social media or adult websites and such.

So using DNS over TLS is not necessarily about hiding my internet traffic, but more also to limit unnecessary content. I suppose the same can be done with a combination of browser extensions. But using the private DNS made sense to me.

Kinda. Not sure how other people do it on NixOs. I suppose they don’t put any network settings in their configuration.

Or maybe there is a way to rebuild offline.

You can connect to your VPN already before changing DNS?

I was interested in having a VPN to my home network which just works over 443, so I can access everything in my home network even on public wifis in a safe way. Haven’t managed to set it up yet though.

What do you use for travel router? Might be interesting as well.

This could be a good option for the library actually.
Maybe I can just check the IP via my phone, then add it to the hosts of my laptop.

I’ll give that a try

A bit cumbersome if you are traveling and using a different public wifi every time though

This is the most straightforward way if I was not on NixOs.

If I want to change the DNS settings in my nix config, I need internet connection (unless it’s possible to rebuild while offline?)

I was trying to bypass this by just changing the DNS server for that specific network connection, but I didn’t get it to work. Because it has to use the DNS of the captive portal to be able to load the page

I was looking at this one: Captive Browser

But would it work if I have my private DNS configured on system level?

I was also thinking to just disable the private DNS and configure it in firefox, but then it would only block trackers/ads in the browser, not in any other application.

Would make it easy to toggle off for a second to login to a captive portal though, or have a separate firefox profile for that (like davel mentioned)