Two physical sites plus a passive off-site NAS.
Active — primary site for media library, family photos, internal LAN services, and most homelab VMs.
Active — primary site for public-facing services (auth, mail, wiki, GitLab, Plex public, websites, customer-facing apps).
Passive — receives periodic snapshots from the Home NAS; no live services.