Ask HN: If you wanted to build the “perfect” home network from scratch

I don't have any real reasons for this other than wanting to protect my young kids/family, protect our personal data, and keeping some element of privacy in an era of it not really existing. I don't live under an oppressive Government (well, any more than anyone does under 5Eyes, but I don't live in China or Syria), so there's no life-threatening requirements. Just that "icky" feeling.

I'm just sick of always worrying about whether the Babycam is "secure" or my kids being exposed to bad ads, or our TV spying on us, and generally just want to get a lot more privacy focused.

I'm assuming at minimum:

- Self-hosted VPN with everything going through it (currently have PIA always-on on every computer and phone, but kids tablet, TV, etc aren't protected).

- IoT on their own subnet? I know it'll mean no connection between my computers and the IoT devices, but I'm happy to also put a tablet on the same subnet for home automation.

- Pi-Hole? Or do this on the VPN?

I've googled around but can't really find any guides on this. I'm open to turning this into a guide on Github if I can get enough responses.

- What modem/router/AP should I be using (currently using the ISP one which doesn't even let me change DNS)