Finally decided to hop aboard the single-sign-on train for my personal services. Authelia and Authentik felt too complex so I ended up on Pocket ID which is both significantly simpler by supporting only passkeys as well as more lightweight to run: pocket-id.org/

So far I've got my #Forgejo and #Miniflux servers migrated which went _mostly_ without a hitch. Next weekend I will probably tackle setting up LDAP!