freeradius is what we used in a small wireless isp I worked at.

FreeRADIUS is the classic (used by most enterprise Wi-Fi gear) but it's config-heavy for a home lab. Most self-hosters reach for one of these instead:

• Authentik / Authelia with a RADIUS endpoint — if you already run one for SSO you get RADIUS almost free; Authentik's outpost speaks RADIUS and backs it with your existing user directory, which is a good fit for 802.1X since you want auth against real identities.
• freeradius in docker (official image) with the eap module — works fine. Main gotchas: clients need the server cert + CA for PEAP/TTLS, and the default users file auth is a trap; use a proper backend.
• OpenWRT's freeradius3 package — fine for 2-3 devices, but router flash/CPU and cert handling make it annoying to maintain.

WPA3 practical notes: many consumer APs only do WPA3-Personal (SAE); for RADIUS you want WPA2/WPA3-Enterprise mixed mode, and check your AP supports dynamic VLAN assignment if you plan to separate IoT from personal devices. Test with a phone before rolling out — EAP-TLS vs PEAP client quirks are where most of the pain lives.

If it's just for learning, spin freeradius in docker with a test AP first, then migrate to Authentik if you keep it.

The usual route for home WPA-Enterprise is FreeRADIUS — you don't need a full package on the router, a small container is enough:

• freeradius/freeradius-server docker image works fine for a handful of clients. Bind it to a fixed IP or use host networking (RADIUS uses UDP 1812/1813 and some APs are picky about source IP), then point your AP's RADIUS auth/acct at it with the shared secret.
• Minimum config: put your AP in clients.conf (secret + IP), create users in mods-config/files/authorize like laptop Cleartext-Password := "xxx", and set default_eap_type = ttls or peap. For WPA3 specifically make sure your wpa_supplicant/client side does PMF (802.11w, required), the RADIUS side doesn't care — it's just EAP.
• Certificates: EAP needs a server cert. Easiest is to run the built-in bootstrap script once (generates a self-signed CA + server cert), then trust the CA on your clients. Phone/laptop clients will complain once until you install the CA.
• Gotchas: run the container with -X (debug) the first time — the log tells you exactly which EAP stage fails; and WPA3-SAE mixed with Enterprise modes confuses some AP firmware, so pick "WPA2/WPA3-Enterprise" as a combined mode if offered.
• If you'd rather not run a server at all: some AP firmware (OpenWrt with hostapd + ucode, or UniFi) supports iPSK (per-device pre-shared keys) which gets you most of the benefit of per-user credentials without RADIUS. Worth checking before committing to the EAP cert dance.

Accounting (UDP 1813) is optional at home; skip it unless you want per-device traffic logs.

I'm not 100% convinced but I like Authentik for its oidc/saml support and switched my very small company over to it a year ago. It also has a radius outpost for authentication at least. I guess I'd go with that for the ease of having the full auth package in one place.