I think Pixelfed can sit nicely behind a reverse proxy, to reduce exposure.

I don’t know if there are prebuilt scenarios for pixelfed in crowdsec or fail2ban but it shouldn’t be so hard to at least write something to prevent bruteforce.