This is such a nothing burger, they’re using those first five to get partial matches then doing the actual checks locally on the hash…

To be transparent: this check isn't new, it has been part of the Supervisor for years. It checks app options that are marked as passwords. A recent release fixed the warning that surfaces it, which is why you're seeing it now. Privacy was a design requirement for this feature from the start, which is why your secrets never leave your system. The Supervisor hashes them locally and sends only the first 5 characters of the SHA-1 hash to Have I Been Pwned. HIBP returns every hash starting with that prefix, and the matching happens on your own instance. You can see exactly what it does here: https://github.com/home-assistant/supervisor/blob/main/supervisor/utils/pwned.py. You are right that our documentation should have explained this, including how to turn it off. We'll get that page updated. ../Frenck

There are multiple tiers of batteries, I got the $50 one I linked but the first hit was $120 on their site.

So you can find the model’s battery here, and then google that and batteries plus. I have an 850M model which uses the rbc17 model. I’ve highlighted that on the apc site on this photo:

Batteries plus had a Duracell version of the one my APC unit needed, in stock in store so I could get it same day. If you’re in the US, might try them.

Which hardware is recommended? Trying to search through their list a ton of it is already on old-stable and seemingly ready to be eol-d. I’m not really interested in spending on new routers playing whack a mole with security updates every 2 years. I’d rather have poor performance and a longer lifecycle versus unknown likely marginal support window.

I use pf as the firewall on my server, what is the difference/reason for the opnsense fork?

They also list my current one as unsupported unfortunately, I think because of the Broadcom WiFi chip in it.

That was one of the things I was considering was whether running a router before the WiFi and then just using them as access points might be a better choice.

Realistically no. My wife primarily uses the ad blocking dns and smb file storage. I’ve built the server on FreeBSD so those should run near forever if I passed, and she knows she has until the server dies to find somewhere else to put her photos. Past that there’s a maintenance document next to the will, which includes everything up to how to replace drives on zfs, but I doubt she’d use it if I’m being honest.