Hi Monkeh,
Actually these mini routers would be OK given that I could change the OpenWRT code to send to various on/off devices
but I'd still need to make a device to send to.
https://www.gl-inet.com/ar300m/
If you go with "OpenWRT" based mini routers route, you may or may not need any other hardware depending on the security you are looking for.
No HardwareOne can add / remove a port programmatically. This can be done remotely through your monitoring system without any additional hardware. OpenWRT exposes a extensive management API over HTTP/HTTPS protocol. The management port can be on a different VLAN for additional security.
Hardware/Side BandAlmost all the "OpenWRT" based mini routers I have worked with have a serial console, but headers are not populated on the board. Some times, there may be tiny amount of rewiring needed to enable serial console. Once you have serial console, you have a side band access to the router(s) in question. OpenWRT exposes a console based management API for managing the routers, allowing you to remove the port(s) from active VLAN. You are free to use any hardware/software combo to access serial console.