**Setup:** 3-node Proxmox cluster on Dell OptiPlex Micros, hosting Nextcloud, Immich, Plex, the \*arr stack, Home Assistant, Zigbee2MQTT (via an SLZB-06 Ethernet coordinator), Pi-hole, Tailscale, NPMplus, PBS, etc. Currently on a flat network: TP-Link Archer AX55 + TL-SG108E managed switch.

**What I'm trying to achieve:**

* Proper VLAN segmentation - IoT isolated from the main network, a kids network with DNS-level content filtering, a guest network, and a homelab network
* Minimise equipment and power outlets - I have one crowded extension lead (ONT, router, switch, 3x Proxmox nodes, Xbox) and want to avoid adding boxes/plugs where possible
* Still want a couple of spare switch ports for temporary wired devices during setup work

**Where I've landed after a long back-and-forth with Claude:** the safe recommendation was a **UniFi Express 7** (all-in-one gateway/firewall/WiFi/controller) replacing the AX55, keeping the existing TL-SG108E switch (for now with a view to replace with unifi switch), and adding a UniFi mesh AP later if coverage needs it.

**But now I'm eyeing further consolidation (forbidden router!):** one of my three Proxmox nodes (an OptiPlex 3060, low utilisation, just running Home Assistant/MQTT/Zigbee2MQTT/Pi-hole/Tailscale/NPMplus/PBS) could be retired entirely. I'd redistribute its LXCs to the other two nodes, then use a **Qotom fanless mini PC with 8x Intel i226-V 2.5GbE)** as a dedicated box running **OPNsense/pfSense or OpenWRT (TBD) + Pi-hole + Tailscale + NPMplus as Proxmox VM/LXCs on the same hardware,** and ideally use a VLAN-aware Linux bridge on that box to also absorb the switch's job, eliminating the SG108E too.

**Claude's take:** fine to retire the OptiPlex and run OPNsense bare-metal on the Qotom. But it's pushing back hard on also virtualising the switch onto the same box. Its argument is that today, a crash/reboot on any one Proxmox node only takes down *that node's* services, because the switch and router are separate physical devices. If the switch itself becomes a bridge inside that Proxmox instance, any reboot (routine PVE/kernel update, container issue, power blip) would kill *all* LAN traffic, not just hosted services, but pve1↔pve3 communication, internet access, AP connectivity, everything, since nothing can physically switch packets while it's down.

**Questions for you all:**

1. Does that reliability concern hold up, or am I being overly cautious with Claude's advice?
2. Has anyone actually run router + switch + core network services (Pi-hole/Tailscale/reverse proxy) combined on one box in a homelab and been happy with it long-term?
3. Given the "minimise boxes/outlets" goal; UniFi all-in-one, dedicated OPNsense appliance + keep a separate switch, or go all-in on consolidation? What would you do?

I'm not a network engineer, just learning all this as I go, and heavily reliant on AI input. Appreciate any real-world experience trying to avoid over-engineering this, but also don't want to build in a fragile single point of failure for the sake of one fewer box.

[ Removed by moderator ]