If you’re buying new cameras they’ll be 802.3af PoE. Passive is becoming much less common. So that model router I linked would work great.

I think if you’re a moderately technically inclined person you would be happy with that solution. If you are intimidated at the idea of writing or adapting some scripts, I would probably recommend a router on one of the other platforms plus a PoE switch.

The easiest part of your requirements are the custom DNS records. All of the platforms recommended so far can do this. OpenWRT has the advantage of WiFi capabilities. If you want the router to also be your WiFi access point then it may be your best option. But it sounds like you only need it to be a wired router, which is good.

As far as the ad blocking, I have done this with pi-hole, and with the built-in DNS and block capabilities of OpenWRT, Mikrotik and OPNSense. They are all fine. The router ones don’t have the fancy web UI like pi-hole. So if you use that a lot you will be disappointed. Mikrotik’s is the most basic and a new feature for them, but they are actively developing it. Plus their current routers can run containers, so you can run pi-hole on the router as a container if you want.

PoE ports as a requirement is what narrows your options considerably I think. You could get that from a separate switch. If you want that in the router itself then you have very few options.

Mikrotik has a lot of routers with PoE out. Their newest model in the RB5009 series can do either passive or 802.3af/at PoE out. Many of their older routers have passive PoE only. Make sure you know what your cameras need.

I had similar requirements as you and got this: https://mikrotik.com/product/rb5009upr_s_in

It has PoE out available on all 8 Ethernet ports. The default 48v power supply works with 802.3af/at PoE. It is a 96 watt supply, and can support ~76 watts of PoE downstream. If you need passive PoE then you would need to change to a 24v power supply.

Mikrotik RouterOS requires some learning to use its advanced features, but their quick setup defaults are good. And the platform is super reliable and flexible.

For DNS you would use their Adlist functionality along with a script similar to the one from BartoszP in this thread to enable DNS name resolution for lan hosts: https://forum.mikrotik.com/viewtopic.php?t=181640. That script is added to the DHCP server config to run when each client gets an address lease. And then you would add static name records in IP / DNS / Static for the other host.domain names you want your lan devices to connect to by name which can’t be resolved via your upstream DNS server.

That SATA port is what you need. You can use that to connect an external eSATA drive enclosure (external jbod).

For a clean install, get a SATA to eSATA adapter - the kind with an expansion slot plate. Something like a STCESATAPLT1LP. Unscrew the eSATA end from the plate, cut a matching hole in the PC case and mount the port to the hole. This is better than going straight from the internal port in my opinion.

It looks like you have a mini-PCIe slot as well, probably intended for WiFi. That may work with an mSATA to SATA adapter to give you a second port. Or it may work with an mSATA SSD. I would test with something cheap or get confirmation it works from other users of this PC before investing in an expensive SSD.

VPN + DDNS is what I do. You may be thinking about the perf hit of putting all your home connections through a VPN. That’s not the idea here. For self hosted services you would set up a wireguard “server” at your house. Then you connect your phone back to it to access your services.

With Wireguard it’s pretty easy to do a split tunnel, so that the VPN connection is only used for traffic to your home servers. Nothing else is affected, and you have access to your house all the time.

This is better for security than DDNS + open ports, because you only need a single open UDP port. Port scanners won’t see that you are hosting services and you wouldn’t need to build mitigations for service-specific attacks.

As far as podman, I am migrating to it from a mix of native and docker services. I agree with others that getting things set up with Docker first will be easier. But having podman as an end goal is good. Daemonless and rootless are big benefits. As are being able to manage it as systemd units via quadlets.

Fascinating

LibreNMS hasn’t been mentioned yet, and it’s very good. It does take some setting up, but its use of SNMP for data collection means that it’s easy to collect data from a wide range of network hardware as well. A wide range of alerting is available.

The WiFi icon with good connection+ exclamation on Android means the connection to the access point is good, but you don’t have a path to the internet. I would start by connecting a PC, wired, directly to your router. Make sure that’s working. If not, get some specifics on what’s failing and troubleshoot.

Then connect to the switch. Repeat. Then connect to an app, repeat.

Mildly what now?

I like LibreOffice Draw for this.

See what’s using the space. This will list any dirs using >100MiB:

sudo du -h -d 5 -t 100M /var

I use LibreNMS, which is a fork of Observium. It is primarily SNMP polling, so if you haven’t worked with SNMP before there can be a bit of a learning curve to get it set up. Once you get the basics working it’s pretty easy to add service monitoring, syslog collection, alerting and more. And since it’s SNMP you can monitor network hardware pretty easily as well as servers.

The dashboards aren’t as beautiful as some other options but there is lot to work with.

Did I read right that it doesn’t use systemd?

Legrand makes a recessed keystone wall plate that may help. There are also other recessed and angled plate options that may help.

Monit works for me. Good basic monitoring solution that can also restart a service/interface.

I also use LibreNMS to do alerting for a variety of conditions (syslog events, sensor conditions, outages and services via nagios). But this is more work to get set up.

I tried draw.io, but ended up liking LibreOffice Draw better for hand-drawing.

If you want to get a live map of the connections on your network you may want to check out netdisco.org or librenms.org. Both are open source network management tools that have mapping.

Obligatory: Debian.

But I’d be tempted to put Proxmox on it and then run containers for each function. Then you get purpose-crafted solutions for each use case, but can easily plug new functions in or shut them down based on what you decide later.

No problems here with AT&T fiber. Yes, you do need their box (the bypass isn’t even possible yet on their new model that they seem to be installing everywhere now). But the IP passthrough works well enough for me so that my router gets the public IP and I can connect to it using any service I’ve tried to host. I make the best of it by using their wifi (which on the BGW320 is pretty decent) for untrusted devices & iot stuff.

Oh, and I use DDNS, but I have never had the public IP change on me.

Keep the tv dumb. Don’t connect it to the internet.

I like to check rtings.com for model specs and comparisons. Like, some panel types work well in a bright room, some work better than others when you are watching with a bright light source behind you. The warehouse clubs (Costco, BJ’s, Sam’s) tend to have good deals on midrange tvs.

Then pair it with a streaming stick of your choice. A generic Android TV stick/box would work.

With what @infinitevalence recommended I think the M700 is a good inexpensive option if you don’t mind doing some work on the case to hack in another ethernet port. Something like this would even get you 2.5Gbe: https://www.aliexpress.us/item/3256804495748525.html

It’s Realtek, but there appear to be OpenBSD drivers. That exact one will not work with the headers hanging off the back of the card (that end of the card is right behind the power button in the front corner of the PC). But if they were desoldered and replaced with vertical headers it would work perfectly. There might be something similar with different connectors, or a 1Gbe Intel card available.

I have a spare M700 that I just opened up to take some measurements. There is ~4mm space above most of the m.2 wifi card with the drive caddy installed, or ~18mm with the caddy removed. Even with the caddy installed there is that ~18mm open space above the back 5-6mm of the card, so a vertical connector there would work , but would conflict with the install/removal of the drive caddy since it slides toward the front of the case to remove. further modification would be needed to use them together.

At the back there is ~50mm side-to-side space between the fan exhaust and ethernet port. Only 32mm if you only take up the space of the accessory video port. In that width you have ~15mm vertical space (above the row of ports at the bottom), and ~32mm depth (from the inside of the case back to the back of the SATA connector for the 2.5" drive). You would basically just need to enlarge the optional extra video/serial port opening.

You could even fit a multi-port interface at the back, up to 50mm wide. But you wouldn’t be able to use the case screw any more since it’s in that space. And you would need to cut the tab it screws into off the case’s top cover. But the case should still close ok because of the way it slides into place.

Now I’m thinking about ordering that adapter for my own machine to hack in a 2.5Gbe port.

The m.2 A+E card/adapter replacing the wifi card is new to me. Very cool.