WireGuard with a domain that only has private ip addresses. Caddy to handle domain certs. I use a split tunnel so my phone is always connected to my local network at home. Everything is http even with private ip addresses

I use frigate and home assistant. I have unraid for storage. I use a small x86 box with openwrt for my router.

I use vault warden (open source version of Bitwarden) for passwords. It’s amazing. And you can use the native Bitwarden client