I use pfsense which has geoip blocking, however this is only going to be a threat if you have open ports, most if not all firewalls are default deny, so what I do is only allow North America and South America (family there).

I might suggest just looking at crowdsec.

If all you want to do is forward to google and redirect internally just use unbound or knot.

I self host vaultwarden but I also pay teh $10/year to support the project, I self host for Collections and I use the paid bitwarden at work since they do not allow ddns addresses in our network.

Another thought and just a thought, if you are going to potentially run a line to your dad’s house, is there talks of you both just getting a faster internet to one home (probably yours) and running a line to his home and setting up access point(s) for his internet?

I would suggest running fiber between the homes with media converters, no change of electric surge with fiber. You could also look at using point to point antennas between the two houses.

Maybe to break the cycle update the firmware to Asuswrt-Merlin looks like the 5300 is supported.

NextDNS is also an option, would be similar to pihole recommendation but just in the cloud. Has a parental control section.

As long as passwords are strong it’s usually fine, I use ldap through jellyfin on authentik and everyone gets a passphrase.

Between them Immich is a lot easier to use, the app is much nicer I have found.

Also if you are not using nextcloud for other features, installing just for photos is a huge drag on resources.

Also immich just added gpu support.

They install just like any other container.

I just use hotio suite which has been great, I run bazarr, prowlarr, qbitmanage, qbittorrent, radarr, sonarr, sabnzbd, and unpackerr on an old asustor nas.

Adguard !== uBlock

One is per device based and the other is solely for DNS blocking, they compliment each other.