None of the clever things in this house work if the boring layer wobbles. A dedicated pfSense router owns the edge, a pair of Pi-holes own DNS, a mesh handles Wi-Fi, and a VPN is the only door in from outside — all of it monitored like everything else here.
pfSense runs on its own small box as firewall, router and DHCP server. The habit that pays off daily is static reservations for everything that matters: every server, VM, satellite, TV and family phone has a reserved address, with only a small dynamic pool left for guests. Reservations are a defensive namespace — the router can never hand an infrastructure address to a passing phone, and every log and dashboard shows a name you recognise instead of a lottery number.
IPv6 is deliberately kept off the general LAN after a run of hard-to-diagnose app breakages; it is a decision reviewed occasionally rather than a permanent position, and it is written down — which is the part most home networks skip.
DHCP hands every client a Pi-hole as its only DNS server — ad and tracker filtering for the whole house with nothing to install on any device. Behind it, Unbound does real recursive resolution rather than forwarding to a public resolver. A second Pi-hole on the second server box means DNS survives either machine being down — and both carry the split-DNS entries that let the public demo pages resolve to the local server from inside the house while the internet reaches them through the front door.
The firewall exports its metrics to the same Prometheus that watches the servers, its logs feed the security monitor, and a daily WAN summary lands on Telegram — traffic, top talkers, anything unusual — so the network gets read like a morning paper rather than investigated only when something breaks.