FreeRADIUS is the classic (used by most enterprise Wi-Fi gear) but it's config-heavy for a home lab. Most self-hosters reach for one of these instead:

• Authentik / Authelia with a RADIUS endpoint — if you already run one for SSO you get RADIUS almost free; Authentik's outpost speaks RADIUS and backs it with your existing user directory, which is a good fit for 802.1X since you want auth against real identities.
• freeradius in docker (official image) with the eap module — works fine. Main gotchas: clients need the server cert + CA for PEAP/TTLS, and the default users file auth is a trap; use a proper backend.
• OpenWRT's freeradius3 package — fine for 2-3 devices, but router flash/CPU and cert handling make it annoying to maintain.

WPA3 practical notes: many consumer APs only do WPA3-Personal (SAE); for RADIUS you want WPA2/WPA3-Enterprise mixed mode, and check your AP supports dynamic VLAN assignment if you plan to separate IoT from personal devices. Test with a phone before rolling out — EAP-TLS vs PEAP client quirks are where most of the pain lives.

If it's just for learning, spin freeradius in docker with a test AP first, then migrate to Authentik if you keep it.