Off the shelf something like and EdgerouterX is great,

You could consider running Crowdsec as well on yr firewall that way known bots will be blocked

I love it

I love it, it’s so nice for quickly jumping between apps

Immich without a doubt

Works great with PIA, highly recommend

I run Dietpi on 3 PIs, one is a remote backup that is wireguarded into my network and my server runs BorgBackup to it

Do what you can to make this the place you want to be.

Wireguard is super quick and easy to setup and use, I’d highly recommend to do that now. I don’t understand the recent obsession with Tailscale apart from bypassing cgNAT