FWIW, you can use Headscale’s embedded DERP server, or host your own. They need a STUN port and an HTTPS port

Ntfy can send/receive notifications to/from the phone. You can selfhost it or use a public instance. For the healthcheck app, consider Uptime Kuma as it has ntfy integration. But a simple cron script that monitors + cURLing ntfy when it fails could also be used.

• Why do you want your own Lemmy instance? Can’t you just create a community on another instance?
• May not be the answer you want, consider exposing your laptop’s service(s) via Cloudflare Tunnels. That’s the best way if you don’t have an exposable public IP.
• Lemmy and other services will make outbound requests and leak your residential IP. If this is a problem for you, you should proxy outbound traffic on the machine
• Have you considered Oracle but in another region? Or do they geo-restrict you?
• For questionable content, look onto moderation tooling for Lemmy. Keep watch on your media folder(s) regularly and delete offensive ones

Protocol-wise, OIDC is generally the most supported out there. LDAP too, to an extent.

Software wise, I find Kanidm quite simple to set up (basically just one container). It’s mostly managed via the terminal though, and lacks some eyecandy. But some of the examples in its docs should be easy to follow and get you familiar with mapping scopes/groups between Kanidm and services.

Authelia is okay too