I also have a "homelab" with minimal maintenance requirements. I'd wager it works out to much less than 15 minutes a month over a year. The strategy is as follows: pin all services to known good versions, deny access from outside LAN, and don't touch it unless there's a new service release with new features I want. Not something I would do at work, but perfectly fine for home setting.

Same. Been using this approach since 2012 and it works very well. I do have TailScale to make access a bit easier, and my AI box has proven to be a bit touchy as I do OS/kernel upgrade that match my ROCm drivers. This got a little bit easier with the 7.x kernels, but even that transition hasn't been super smooth. Will probably spend a feelw hours tonight getting it back in shape, but all my other machines are as you describe: almost fire-and-forget!