It lives on an isolated VLAN with traffic routed through a VPN service on a dedicated NAS for movies. If someone gets into it, they’ll get no personal info but my movies.