R86S has the N100/N305 version which is a lot faster.

Anything with Kaby Lake is good enough, with Tiger Lake it’s even better. So if you look for used PC should choose at least Core i3 8th Gen, or Gemini Lake like Celeron J4125. New purchase just go for N100, basically unbeatable.

https://en.m.wikipedia.org/wiki/Intel_Quick_Sync_Video

TRIM on Pi is possible if the USB controller supports it. Even without TRIM the USB SSD is ALWAYS having longer life and running a lot faster than SD card, and not to mention sometimes we need much bigger storage only (e.g. previously I used my Pi4B as torrent client alongside with PiHole/UPS management, plugging a SSD to it just fits the purpose)

And not everyone is buying Pi at high price, for example I have 3 x Pi4B purchased long time ago which were cheap.

As long as you are able to deal with mDNS (either allowing broadcast through VLAN, or with reflector), your Chromecast and/or Apple TV can be on a separate network without problem.

QNAP is a big NO…looking at their track record on security…

​

If you want to build one, you can think about getting TerraMaster 4 bay with Intel based CPU, replace the boot USB stick and you can boot your own NAS software

I suggest OpenWrt, for me I have GL-INET MT1300 (Beryl) which is a travel size 802.11ac router with OpenWrt 23.05.x firmware which provides great feature and security, if you want more processing power and/or higher line speed you can even go with GL-INET MT3000 (Beryl AX) which has 2.5G WAN port + 802.11ax WiFi!

840N…wow… can’t remember how old it is, probably now any router you can get would beat it.

Cheaper option could be Netgear WAX206.

Have been managing email server for my friend’s small business but eventually we also decided to use vendor because the cost of maintenance is high.

BSD as a virtualization host doesn’t seem to be good, so better stick with Linux.

I would just run Jellyfin or other stuff with LXC, of course firewall should be in VM, probably only needs 4G ram and it’s more than enough.

If you can completely isolate it so that only management network+ unRAID are reachable, then it’s fine.

Outside network is one attack domain, however don’t forget that if your PC or other mobile devices on network are infected by virus or malware, they can initiate attack from inside, look at the case of WannaCry in the past.

Just PiHole and then VPN with split tunnel so that only DNS is using home one.

Flash OpenWrt on ER-X and try to see if you feel it working better.

PiKVM allows you to control the machine even without OS. Remote desktop requires you to have the machine installed OS + setting up RDP properly first.