Regardless of whether or not its worthy of discussion, this is heavily AI assisted at least, and GrapheneOS does not allow "walls of verbose text" (which this certainly is...) generated by AI.
I have seen 6 port minipcs like this one https://cwwkpc.com/products/mini-pc-firewall-c6 so number of ports is not an issue as long as you are prepared to pay for it. I think you'll find more ports with similar keywords (industrial, firewall, fanless, etc).
My setup, which I think works well, is to have OPNsense on the miniPC as router/firewall, and separate WiFi APs. This setup has lasted me around 5 years now and will probably last as long as OPNsense and openWRT (for my APs) had decent support for my hardware. Well worth the money and effort in my opinion, and separating the router/firewall from the AP allows you much more flexibility.
Take a look here, it explains more about the specific configuration, such as which subvolumes are automatically snapshotted and include in rollbacks, bootloader integration, etc
https://doc.opensuse.org/documentation/tumbleweed/snapper/
Basically there are many details in the setup of btrfs that are needed to get to that level where you can be confident of being able to easily rollback to a previous state. After losing some data on a manually configured btrfs setup on Fedora I went to openSUSE specifically because they have already done all the hard work for you on the btrfs config
Netmaker is crap compared to Netbird unless you really need nodes to connect with native wireguard. Netbird has better ACLs setup, clearer documentation, and even has a new reverse proxy feature
This is what openSUSE Tumbleweed is designed to do, although config files in /home require manual setup to include. It allows you to completely rollback if necessary after a system upgrade, allowing you to use a bleeding edge distro without fear of having an unusuable system. If an upgrade goes bad, usual procedure is to roll back to the last btrfs snapshot and just wait for the fix (which usually comes in a couple days to a week, as Tumbleweed advances rather quickly).
openSUSE has a specific btrfs subvolume setup and grub/systemd-boot integration to enable this, which is not too common even today, so it really is a bit special in that you can have this functionality without excessive time spent setting it up manually.
Regardless of whether or not its worthy of discussion, this is heavily AI assisted at least, and GrapheneOS does not allow "walls of verbose text" (which this certainly is...) generated by AI.
https://discuss.grapheneos.org/d/11951-ai-generated-text-is-forbidden-with-the-exception-of-automated-translation
Maybe if this person cared enough to follow the forum rules there could be discussion on this topic.