Understand the systems you own.

Run Vaultwarden on your existing Ubuntu/Docker home server and sync a private password vault across trusted devices over tailnet-only HTTPS without exposing the service to the public Internet.

Build a dedicated OPNsense edge firewall with a managed-switch trunk that isolates Trusted, Guest, IoT, and Lab devices into separate routed security zones.

Run NetAlertX on your existing Docker homelab to inventory one local LAN and clearly flag a device the first time its MAC address appears.

Enable Suricata IDS on your existing OPNsense firewall, inspect routed home-network traffic with ET Open rules, and learn to verify and tune real alerts without blocking packets.