I should probably write a blog on how to do this. I have a setup guide for myself, but unfortunately it contains a lot of obviously private details that I can't post (ie access to my cloudflare/VPN stuff).
A lot of my stuff is ad-hoc from my personal exploration and experience on Linux.
In regards to the wireguard specific stuff, this isn't a bad guide.
https://mikkel.hoegh.org/2019/11/01/home-vpn-server-wireguar...
The harder part with the VPN stuff is the following.
1) Setting up a clear route of forwarding traffic to the pihole. To do so, you would need to setup netplan/systemd-networkd so your pi gets a static private IP. (Not that easy if you are doing a full ipv6 route too.)
2) Setup a DDNS mechanism (as you most likely are getting a dynamic IP). My suggestion for this was to get a domain name (8 quid a year) and use cloudflare as a DDNS host. You also need to punch a UDP port through your router to forward to your pi.
3) Then setup the rest of the wireguard stuff.
4) Setup the pihole and ensure all interfaces are covered so your VPN has a DNS server.
Part 2 is the hardest bit as I kind of needed some custom scripting to ensure cloudflare had working routes to my networks. e.g. https://gist.github.com/Kedstar99/2d8ab0e9bec3a5629562b4ab01...
The above script obviously running as a systemd service that restarts automatically.
Obviously you can use something else like noip or some other DDNS solution.