Clients -> dnsmasq -> PiHole -> Unbound

TrueNas core.

Any switch that does not say cisco on it is a good switch.

Unattended updates are a recipe for trouble. I’d never enable that.

I have no public services apart from 2 OpenVPN servers. To access everything else I connect to one of the OpenVPNs and use the services through the VPN routings.

The VPN can only be accessed if you possess a cert and key. I could even implement 2fa but for now SSL auth works securely enough.

You would not want to buy this E-Waste for that much money.

Definitely not. You’d have to pay me money to take this trash off your hands.

Definitely not. You’d have to pay me money to take this trash off your hands.