Agree with all the comments here - old iPads make a great dashboard for Home Assistant (and most other home automation systems). If you want to wall mount it there are several vendors that offer surface or flush mount. Get yourself a poe to usb convertor and you’re done.

I might get in trouble for saying this on this channel ;) - BUT - If memory serves, Proxmox has native support for backing up to an AWS S3 bucket. I think I paid something like $3/month for it when it was setup - very minimal. While not really “self hosting”, I would argue backups are the one thing you should actually do offsite, ideally with some resiliency.

Honestly, OPNSense has some fairly decent reporting that can take you a fair ways. https://docs.opnsense.org/manual/reporting_traffic.html

Watching the traffic in those tools can highlight a lot of concerns. Is outbound wide open from all networks?

In general, I wouldn’t recommend doing auth at the network layer. You could do radius, AD, or something similar if that’s a concern. You could use Tailscale and create a mesh overlay - I’d do that before VPN. Going down this road can, of course, cause a lot of challenges with phones and other iot devices. I tend to keep the iot vlan barebones for that reason.

At a minimum, I always do trusted, guest, and iot. I used to do “family” but, honestly everyone just ended up on iot because it was easier to control everything from their phones. Management is done from trusted. My current setup also includes DMZ and DC vlans for the homelab. I added a gaming vlan for one gaming PC the other day and moved that machine to it since games always have a bunch of port forwarding needs.