Over the last 2 weeks I moved file services to a spare NUC (#CentOSStream 10) and replaced the Ziply (ne' Comcast) router with 2 #Openwrt routers (Banana Pi r4 and an old WRT1900ACS): untrusted systems on the WRT, trusted on the BPi... Separate SSIDs, network segments, and of course physical separation all in effect. Heavy firewalling in all 3 directions, minimal holes for Sonos to talk to Samba and desktops get to a network printer.