I use a single old PC at home. Put debian on it, install docker and unattended upgrades. Create docker compose files for all services. Make sure to use 'latest' everywhere and run watchtower to update all images regularly. While i expose a select few services to the internet I connect to most of them via VPN. In the local network I'm using pihole for local DNS and since I use a wildcard let's encrypt certificate I have ssl for everything which makes it nice to use.

Haven't had to touch the system more than once a year or so when I got an alert that unattended upgrades couldn't install something.