Which reminds me to mention that the Radxa ZERO 3E [0], which was announced last November, is now for sale [1] (since last week).
It's basically a Raspberry Pi Zero with the difference that it has a gigabit ethernet port instead of WiFi+Bluetooth.
This is not an ad, I've ordered two because my OpenVPN server which runs on a Raspberry Pi B+ (1st gen, 9 MBit/s throughput on Bookworm) needs upgraded hardware.
In that context, it's remarkable that Bookworm still runs on an device as old and weak as the 1st-gen Raspi.
Perhaps you have reasons for avoiding it, but have you considered researching Wireguard for your VPN? It's pretty night and day the throughput you can get out of it -compared to OpenVPN.
It's also really amazing when it's used in mesh VPNs like Tailscale.
It's a legacy setup and it's working. I did some tests last year with Wireguard and among the problems I encountered were the lack of reconnection upon IP address change. I tested it with a couple of VPS and devices in the LAN, and for some reason it failed to work reliably, like for weeks and surviving reboots of random machines.
My setup bridges two home networks into one with two different subnets.
Long term I definitely want to use Wireguard, but for I'll continue using what works reliably.
Regarding Tailscale, I don't want to use 3rd party services for this.
If you want to avoid third party services Tailscale works with the community project Headscale that you can self-host. It's even gotten patches from Tailscale themselves.
https://headscale.net/
Can't remember the exact name but I remember seeing a similar pi0 sized board with POE ethernet and an m.2 slot for wifi, and thinking it'd be perfect for a WAP.
Unfortunately it was a industrial vendor so don't think you can buy it in low quantities and the price is probably way too high for what it is.
I feel like there must be a market for something like that tough, a board with the bare essentials to make it cheap enough to have a few around the house / office and leave it up to the customer to find a wireless card that could be upgraded down the line.
It's basically a Raspberry Pi Zero with the difference that it has a gigabit ethernet port instead of WiFi+Bluetooth.
This is not an ad, I've ordered two because my OpenVPN server which runs on a Raspberry Pi B+ (1st gen, 9 MBit/s throughput on Bookworm) needs upgraded hardware.
In that context, it's remarkable that Bookworm still runs on an device as old and weak as the 1st-gen Raspi.
[0] https://radxa.com/products/zeros/zero3e/
[1] https://arace.tech/products/radxa-zero-3e