just install Cockpit with Debian, and headless is better as the GUI is a security vulnerability
https://www.redhat.com/sysadmin/getting-started-linux-security
Use a old PC with Pfsense, Opnsense, or OpenWRT, as you can buy a MELLANOX CONNECTX-3 for like $25 on ebay, and you can get a Good AP that supports OpenWRT for like $70-$100, and a switch for like $120 that has one 10Gb in and one 10Gb out with 4-8 2.5Gb ports. I do recommended Opnsense then you can have IPS etc. https://docs.opnsense.org/manual/ips.html
not really wireguard hits ARM CPU’s hard. you can also get n95/n100 mini PC’s as well for around the price of a Orange Pi 5 and use Intel’s awesome encoder for jellyfin.