Like I'm not getting a dedicated router and have no server room in my apartment, and my consumer router only supports two VLANs (main and guest). But I'd say the rest is rather sophisticated with all machines defined in my NixOS config, including automated generation of firewall and reverse proxy rules for which I wrote custom modules.

Media server isn't super full but connected to jellyseer and the rest of the stack, accessible over TLS (Let's Encrypt certificates) only, with the option to have users managed via IDM.

However, I only have devices on my network that I somewhat trust, with an Android TV box being the worst offender. The smart TV was never connected to my network.

Would be cool to isolate my work PCs somewhat (I work from home with company provided equipment) but it's just not worth the trouble in my opinion. Not switching out a low power device that does most for two different devices that both use more power (since you usually need a router and a modem).