I might get in trouble for saying this on this channel ;) - BUT - If memory serves, Proxmox has native support for backing up to an AWS S3 bucket. I think I paid something like $3/month for it when it was setup - very minimal. While not really "self hosting", I would argue backups are the one thing you should actually do offsite, ideally with some resiliency.

Honestly, OPNSense has some fairly decent reporting that can take you a fair ways. https://docs.opnsense.org/manual/reporting_traffic.html

Watching the traffic in those tools can highlight a lot of concerns. Is outbound wide open from all networks?

In general, I wouldn't recommend doing auth at the network layer. You could do radius, AD, or something similar if that's a concern. You could use Tailscale and create a mesh overlay - I'd do that before VPN. Going down this road can, of course, cause a lot of challenges with phones and other iot devices. I tend to keep the iot vlan barebones for that reason.

At a minimum, I always do trusted, guest, and iot. I used to do "family" but, honestly everyone just ended up on iot because it was easier to control everything from their phones. Management is done from trusted. My current setup also includes DMZ and DC vlans for the homelab. I added a gaming vlan for one gaming PC the other day and moved that machine to it since games always have a bunch of port forwarding needs.

I've honestly had decent luck with APC but also ran a lot of Tripp Lite. Eaton is decent. Using their calculator, this model (https://www.eaton.com/us/en-us/skuPage.5S1500LCD.html) would run for 71 minutes on a 100W load. It's going to be hard to get below $300 for an hour of runtime. You're going to want to target 1000VA or above.