You could also route any calls to /api through authentication. However I am not sure if that can cause any problems. Is there a list of endpoints that need to be reachable for federation to work?

Never noticed anything in the last couple of weeks. I had one podcast missing new episodes because the schedule was turned off. But I might not have had it turned on in the first place.

ntfy and FreshRSS for me. Audiobookshelf recently joined and I am using it daily. (Inofficial probably the Arr stack though 😅)

Make sure to set up an emergency sheet (https://passwordbits.com/password-manager-emergency-sheet/) and have it available at one or multiple safe places.

You can also check out 2FAS, which recently got open-sourced. It comes with browser plugins to autofill 2FA pushed from the phone on request. Makes it a lot more convenient if you need another reason to switch.

As a follow up. I went with wireguird, working fine so far.

They do allow to reply, simplelogin also has no limitation on reply count.

If it is just for email forwarding maybe a service like https://anonaddy.com/ or https://simplelogin.io would work. Catch-all is even included in the anonaddy free plan as that is something you actually do not want to have enabled 😄 For your custom domain you have to have the lite plan at least though.

Will check that out 👍