If you got cash to burn, Protectli devices are nice. Random chinese Celeron boxes with 2.5g PHYs will do the job just as well, just without Coreboot. APs should always be seperate, imho.