Agree with all the comments here - old iPads make a great dashboard for Home Assistant (and most other home automation systems). If you want to wall mount it there are several vendors that offer surface or flush mount. Get yourself a poe to usb convertor and you’re done.

I might get in trouble for saying this on this channel ;) - BUT - If memory serves, Proxmox has native support for backing up to an AWS S3 bucket. I think I paid something like $3/month for it when it was setup - very minimal. While not really “self hosting”, I would argue backups are the one thing you should actually do offsite, ideally with some resiliency.

Honestly, OPNSense has some fairly decent reporting that can take you a fair ways. https://docs.opnsense.org/manual/reporting_traffic.html

Watching the traffic in those tools can highlight a lot of concerns. Is outbound wide open from all networks?

In general, I wouldn’t recommend doing auth at the network layer. You could do radius, AD, or something similar if that’s a concern. You could use Tailscale and create a mesh overlay - I’d do that before VPN. Going down this road can, of course, cause a lot of challenges with phones and other iot devices. I tend to keep the iot vlan barebones for that reason.

I’ve honestly had decent luck with APC but also ran a lot of Tripp Lite. Eaton is decent. Using their calculator, this model (https://www.eaton.com/us/en-us/skuPage.5S1500LCD.html) would run for 71 minutes on a 100W load. It’s going to be hard to get below $300 for an hour of runtime. You’re going to want to target 1000VA or above.

At a minimum, I always do trusted, guest, and iot. I used to do “family” but, honestly everyone just ended up on iot because it was easier to control everything from their phones. Management is done from trusted. My current setup also includes DMZ and DC vlans for the homelab. I added a gaming vlan for one gaming PC the other day and moved that machine to it since games always have a bunch of port forwarding needs.