I always run occ upgrade and occ db:add-missing-indices after a package upgrade, just to be sure that I do not miss any database migrations. Using Archlinux I wrote a pacman hook so that it happens automatically.

You could have a look at Kerberos. That’s what Microsoft took as base for AD afaik.

I had no problem to install my CA on my Pixel (Android 13). I read that this was not possible for some time but Google changed it.

You know their tuning page? I did several of their suggestions and they helped me. https://docs.nextcloud.com/server/latest/admin_manual/installation/server_tuning.html

Been there (postfix+dovecot). I gave up postfix at some point and now use fetchmail for mail retrieval into dovecot and the clients send mails directly via the mail hoster’s mail server.

• buildbot for archlinux package builds
• dovecot with fetchmail for mail retrieval
• fail2ban with very strict rules against all those bots
• gitea for my own projects
• home-assistant with some usual backend stuff like knxd, zigbee2mqtt, mosquitto
• navidrome for the music collection
• nextcloud with very few apps
• vdr for recording TV shows from satellite with a smartcard reader for the local television smartcard
• octoprint on the 3D printer
• pacoloco, an archlinux package cache
• paperless for document management
• teamspeak

All services are configured and deployed using saltstack and monitored with sensu. I do not use containers but I have all services hardened by hardening the systemd service and/or apparmor profiles.

Backups are done using btrbk.