I ended up building my own image of OpenWRT to make the package hell better on upgrade, and as a bonus, I was able to build in my configs too. Recovering from a failed Pi was as simple as flashing the most-recently-built image. Upgrading just required rebuilding the image (and resolving whatever went wrong, of course, though it was usually pretty light). As a bonus, it's easy to swap SD cards on the Pi so I can have the last "known good" config available while taking the update.

Now I run OpenWRT on one of those x86 mini PC boxes with 4x 2.5GBe Intel NICs because my wirespeed is 2 Gbps symmetric, so I needed just a bit more oomph than the Pi could provide. The hardware is somehow even _less_ reliable than a Pi 4 - I'm already on my third machine in 3 years. I would love to find something more reliable.

OpenWRT has also made it incredibly easy to package in any arbitrary pkg into image downloads from their website. You don't need your own build infrastructure now.

I'm curious what your experience would be like with a Pi5/CM5 solution using PCIe for your ethernet. It is pretty easy to have spare boards and SD cards around for Pi setups. I've had good reliability with Pi setups using good passive cooling (no fan to die).