What these services actually need
Very little. Pi-hole's prerequisites are 2 GB of free disk space (4 GB recommended) and 512 MB of RAM, on a supported Linux such as Debian or Ubuntu. It needs a static IP address, or a DHCP reservation on your router, and it listens on port 53 for DNS and ports 80/443 for its web interface. A WireGuard or Tailscale endpoint and a reverse proxy add little on top. The reason to use a mini PC rather than the smallest possible device is that it runs all of these at once, plus whatever you add next, from a real SSD.
One box, several small services
- DNS filtering: Pi-hole or AdGuard Home blocks ads and trackers for every device on the network once your router hands out the mini PC as the DNS server.
- Remote access: WireGuard gives you a fast VPN back into your home network; Tailscale builds a mesh on top of WireGuard and handles keys and NAT traversal for you.
- Reverse proxy: Caddy, Nginx Proxy Manager or Traefik put HTTPS and friendly hostnames in front of Home Assistant, Jellyfin and anything else you self-host.
One detail if you stack them on one host: Pi-hole's docs say that if another web server is already listening on port 80/443, Pi-hole's web interface will try 8080/8443 instead. Decide which service owns 80/443 (usually the reverse proxy) before you install. Running each service in its own container, or in LXC containers under Proxmox, keeps them from tripping over each other.
Plan for DNS downtime
When the DNS box goes down, every device in the house seems to lose the internet. Give clients a second resolver, either a second Pi-hole instance on another machine or your router's own DNS as a fallback, and set the mini PC to power back on after an outage in the BIOS. Business tinies and most ODM boxes offer this; CNX's spec listing for the EQ13, for example, notes BIOS support for Wake-on-LAN and auto power-on.
Router builds: OPNsense and pfSense need two ports
A firewall distribution such as OPNsense or pfSense needs at least two network interfaces: one for the WAN side facing your modem and one for the LAN. OPNsense's hardware guide sets out three tiers: a minimum spec of a 1 GHz dual-core CPU and 3 GB of RAM, a reasonable spec with 4 GB and a 40 GB SSD, and a recommended spec of a 1.5 GHz multi-core CPU, 8 GB of RAM and a 120 GB SSD, which it pairs with 350–750+ Mbps of throughput. It also recommends Intel NICs for reliability and lower CPU load.
Most 1-liter business PCs have a single onboard port, so you have three routes. First, add ports: Lenovo's PSREF for the M720q and M920q lists a 4-port Intel I350-T4 PCIe card, which takes the place of the 2.5-inch drive. Second, use one port with VLANs and a managed switch, which works but is harder to set up and troubleshoot. Third, buy a dual-NIC ODM box: the Beelink EQ12 has two 2.5 GbE ports on Intel I225-V controllers, and its successor, the EQ13, has two gigabit ports. CNX ran pfSense in a VM under Proxmox on the EQ12 alongside TrueNAS and found plenty of headroom, though bare metal is simpler for a box whose only job is routing.
On the 2.5 GbE side, ServeTheHome singles out the Intel i225 B3 stepping (chip marking SLNMH) as the version it recommends. The EQ12 reviews we checked don't say which stepping Beelink used, so if it matters to you, ask the seller or check the chip marking.
Power: an N100 is not automatically lower than an old tiny
It's easy to assume a 6 W N100 idles far below an 8th-gen Core business mini. The measurements we found say the gap is small. CNX measured the N100 EQ12 at 12.1–14.3 W idle, and its reviewer later reported 10.8 W under Proxmox after switching to the powersave governor. ServeTheHome measured a dual-core ThinkCentre M720q at 11–14 W and a six-core HP EliteDesk 800 G4 Mini at 11–12 W. Pick on ports, RAM and supply first; idle power is roughly a wash.
Where to go next
If this box will also run Home Assistant or workflow automation, size RAM for those. If you're adding cameras, Frigate benefits from the isolated camera network a second NIC gives you. A media server, an AI agent server or a local LLM belongs on a bigger box; keep DNS on something boring and reliable. Compare ODM brands in Beelink vs GMKtec vs Minisforum, and check any used unit against the buying checklist.