I make it simple for myself - only WAN ingress into my network is openvpn protected by both username, password and client certificate files.

https://github.com/jgraph/drawio-desktop

https://www.drawio.com/ could probably work

Replace NAS drives with larger ones and then repopulate data from your backup? That way you get to test your recovery and restore procedure at the same time.

For WebDav I would look at https://github.com/sabre-io/Baikal
Unless you want all the other parts of Nextcloud and need the big package.

Just like navidrome it seems like Jellyfin reacts to failed mounts by emptying libraries.
https://forum.jellyfin.org/t-solved-network-not-mounted-before-jellyfin-starts

With version 10.11.0 they offer a built in backup system for db/metadata/subtitles though so once access is restored it’s easy to restore any metadata changes you’ve done to your library. (As long as you got a backup since before that is)
https://jellyfin.org/docs/general/administration/backup-and-restore/#create-a-backup

Nothing is hard when you know what you’re doing. :)
Being able to completely wipe your compute machine and not worry is nice and imo easier.

For only Jellyfin, then I agree - if that is where it stops you could run it all on an N100 integrated motherboard and have a lean sleek system that hosts your files and your streaming server. But when your services starts being too much for the N100 then it’s nice to separate it a bit and for me it feels natural to split it between compute/storage.

Separating your services from your storage makes things a lot easier in my opinion.
Setup one machine as a NAS and have that manage your (preferably redundant and backuped if storing personal photos or other unique data) storage, then share it to the rest of your selfhosting over nfs and smb.
You could either go for a prebuilt NAS like Ugreen NASync DXP2800 or build your own m-itx with a Jonsbo N2 case and an N100 motherboard or whatever you’re comfortable with.

Your jellyfin server then accesses the media libraries with a simple mount (/mnt/media). Same with your tdarr server and tdarr nodes.
It’s much easier to experiment and reinstall services when you have your storage separated from them.

I can’t buy a 14tb hdd for that price here in Sweden, but I have no idea about your local prices. Is it new or refurb?

Ah, I can see the appeal but it’s not for me then. :)

What is the gain compared to running something battle tested like zfs or mdraid?

Made a screenshot of https://app.smartdraw.com/editor.aspx?templateId=384d7d86-2472-4f4d-b80f-224189376dc3&flags=128

Does this example match your network?

From your description it already sounds like all of it is in the same network?
That cabling you have in the house doesn’t split your network, Router -> CAT6 - CAT6 - CAT6 -> Switch is the same as Router -> CAT6 -> Switch as far as your equipment is concerned.

This is oversimplified but catches most network topologies (including yours it seems):
Internet -> Router -> Switches -> Client Devices

Isnt opnsense only for bsd? I am running linux.
opnsense is bsd based yes, you can either run it on it’s own hardware in front of your server or you can run it as a virtual machine and passthrough your hosts network ports to it for WAN/LAN.

When using a vpn server, only I could access the services right?

You can easily setup vpn users for friends/family but a random person on the internet won’t reach your services if you block access from WAN and forces everyone to go through the vpn server.

Your services would first of all need some sort of integration to report failed authentication attempts to your firewall or you wouldn’t have anything to act on to start the block. Sounds complicated edit: and also what fail2ban does by reading logs it seems.

If I were you I would ponder if it wouldn’t be easier to just setup a headscale/wireguard/openvpn server and connect to your other services through that.

My favourite home firewall right now would be opnsense

Powerline communication uses adapters to transmit network signals over existing electrical wiring, avoiding the need for new CAT6 cables and offering a hardwired internet connection in hard-to-reach areas where running Ethernet is difficult or impossible (or where the house owner simply is too lazy).

Having the motion sensor trigger saving local recordings is an idea that have gotten a positive dev response.
https://github.com/themactep/thingino-firmware/discussions/289

I can’t find any discussions about accessing recordings using ONVIF or the tinycam app and don’t have any cams running personally.

I am planning on using thingino with frigate nvr and network storage later on so thanks for sharing your experience!

What I like about running a hypervisor and true vms is that I can fool around with some vms in my server without risk of disrupting the others.
I run most of my dockers in one VM, my game servers in another and the Jellyfin instance on a third. That allows me to fool around with my portainer instance or game servers without disrupting Jellyfin and so on.
Part of it is that I’m more used to and comfortable in managing vms and their backup/recovery compared to LXCs and Dockers.

I’ve never tried Arch but my debian server with kvm/qemu/cockpit running mdraid1 and smb/nfs file sharing - works well enough and I enjoy the tinkering and setting it all up. I’m writing this from a virtual Fedora KDE workstation that I’ve setup vfio and pcie passthrough of my dgpu and a usb controller on (both connected to my monitor that acts as a usb hub).

A friend runs a Proxmox VE Community Edition with physical disk passthrough to a virtual Nextcloud server and that seems to work well too.
I guess my answer is no, I don’t look at UnRAID and think “fuck this shit I’m done”, I enjoy the tinkering that makes you frustrated.

May I ask what kind of brick walls you’re hitting and what software you run on Arch that makes it so frustrating?