My number one is going to be my firewall, OPNsense. I would not use the ISP provided one. I'm, also, using this firewall VM as my reverse proxy, radius, ad blocker, DNSSec, DoT, etc.

The second one would be my hypervisor, Proxmox. I use three NUC8 cluster with ZFS replication for my critical VMs such as the OPNsense, FreePBX, and some.