If both Caddy and Forgejo are running in Docker containers you could do SSH Container Passthrough.

Link is to Gitea docs but should work fine with Forgejo.

Pihole will also block non-browser traffic (e.g. your OS phoning home). Adblocking extensions are typically restricted to just blocking traffic of the browser it’s installed on.

It also operates on your entire home network, so it can block junk traffic on devices that can’t run adblockers.