I have a UniFi EdgeRouter-X and two UniFi APs. I'm happy with the APs satisfied with the ER-X. Once nice feature on the ER-X is their Smart QoS; you specify your broadband UL/DL rate and the router does a good job of preventing single devices from monopolizing your pipe.

I've been looking into replacing my router with something that can host a VPN that I can connect to on the go. I don't think the ER-X can fully utilize my broadband with L2TP/IPsec or OpenVPN so I'm looking for something that can run Wireguard.

Right now I'm eyeing a PC Engine APU2 [0] running OpenWRT. I think it's powerful enough to meet my needs and would also function as a pi-hole. This setup will require more setup than the ER-X but it also is more customizable.

My UniFi APs are upstairs and downstairs. Since my place isn't wired I am using some MoCA devices [1] over coax to get everything connected.

[0] https://www.pcengines.ch/apu2d4.htm

[1] https://smile.amazon.com/dp/B013J7O3X0

IPSec is lower CPU and higher throughput on the ER-X compared to OpenVPN, but the device is also capable of running wireguard, with the right firmware. And WG will beat IPSec hands-down, at least in the benchmarks I’ve seen.

For me, the bigger concern is that the configurations for WG on the ER-X are still pretty beta, as is connecting to any WG server on the other side that you didn’t build yourself. Service provider support for WG is limited and the configuration management there is still quite clunky.

For my home router I use a UniFi gateway pro - probably overkill but it’s nice and works. For my office we initially used a UniFi gateway but while testing voip phones I found it was not adequate for voip traffic so I bought a $1k dell server configured it with linux and iptables for failover from our primary fios to our backup Comcast .... I think I would roll my own if you have time otherwise UniFi is great

My home router is a Linksys WRT3200ACM running the latest OpenWRT. I only set it up this week when I moved into my new apartment, so I haven't quite put the wireless through its paces yet, but over ethernet it keeps up with my near-gigabit (900-ish Mbps) WAN just fine.

I have edgerouter X with cake

For a router, anything will do. I personally use an entry-level Mikrotik RouterBoard and it works great with a gigabit symmetric connection.

The hard part is wireless, and the answer will depend on a few factors:

1) Are you able to run Ethernet to each AP?

2) If not, are you able to use powerline adapters to bring network access to the APs (and get decent speeds there, test that with iperf3 - you usually get 1/4 of the advertised speed on powerline adapters)?

3) If not, is there good enough wireless performance between every place you're going to have an AP if you were to go with a mesh-based system? Mesh will only work if you can get wireless to the APs in the first place and a lot of consumer-grade mesh-based system completely overlook that fact in their marketing.

For 1) Unifi is good enough, otherwise check out other enterprise-grade wireless access point systems. Don't bother with consumer-grade stuff, it's all garbage for the most part. It's up to you if you want to use a Unifi Security Gateway as your main router as well, but it's not required if you just want the APs.

For 2), find good powerline adapters, test them with iperf3, and if good enough then connect enterprise-grade APs to them. Alternatively, if you want an all-in-one unit (powerline adapter with AP) I can personally recommend the Devolo DLAN 1200 WiFi AC, with real-world Wi-Fi performance of around 150Mbps in an interference-heavy area. This might not be much but it's absolutely consistent and latency is always low so it's more than enough for mobile devices IMO. Put one of those in every room. One caveat: you WILL need to build & install OpenWrt on them as the default firmware is garbage and doesn't support 802.11k nor Fast Transition, which is the difference between devices roaming seamlessly and not roaming at all. This is also why enterprise-grade Wi-Fi systems are key and consumer-grade is a waste of time.

For 3) I would personally look into solving 1 or 2 first. Mesh systems seem like a huge hack; wireless spectrum is precious and should be used for AP to mobile device communication, using it for backhaul seems extremely wasteful. It might work in a no-interference area but in a crowded apartment block there might not be enough unused spectrum to make it work, and you'll get inconsistent performance with random moments of packet loss, etc which is much more disruptive than slow but otherwise consistent performance (I'll take 10Mbps with zero packet loss over 100Mbps that craps out randomly at unpredictable times).

Finally, one key piece of advice: measure. Wi-Fi and networking is not some magic spirit-based system that acts on its own, it works according to a specification and mostly common sense. If it doesn't work there's a reason. Measure wired connectivity to the APs (a good tool for that is iperf3), then measure the wireless interference around you (put your laptop's Wi-Fi interface in monitor mode, capture some traffic, you can use airodump-ng to hop between channels and create a CSV of all the APs nearby so you can select the best channel for each zone), etc. The reason enterprise Wi-Fi usually works well despite dozens of devices around is because people who install them do what I just said, while consumers just buy a 500$ set of magic boxes at their local store (recommended by the low-wage employee who just needs to sell them) and expect it to work.