For auth providers, I’ve tried all the ones you named. Here’s my brief analysis:

• Authelia - deployment and configuration is moderately complex but documentation is great and it works well with Caddy reverse proxy.
• Authentik - way too complex to deploy and configure, requires you to understand their concepts very well. I’d stay away from it.
• PocketID - super easy to deploy and configure. Passkeys are easier and arguably more secure than passwords and it supports a few methods other than passkeys.

With these services you mentioned you want to or are already hosting, you could use the following in the order they are listed:

1. Basic auth using Caddy (reverse proxy layer)
2. Anubis to ward off bots and scrapers (between reverse proxy and hosted service)
3. PocketID for auth (before service as single sign-on)

I would recommend 2 and 3 as 1 is pretty useless against a determined attacker. Anything that’s on the public internet is bound to be attacked at some point, so follow best practices and perform server hardening on the host machine. Remember, you classify the sensitivity of the data you host and determine the severity of the risk if that data were to be exposed. So work with that in mind when choosing an option.