I've been using Authelia with several OIDC integrations for a while now. Works great. They've released a huge update like a day ago too. Out of the ones you listed, it's very lightweight too. The docs are a bit all over the place but it is quite comprehensive.
I did look at Zitadel and tried setting it up myself but I just couldn't get it to work. The docs are a bit vague.
I think it's still good to go with the HDD instead. You can always later get M.2 SSD with a USB enclosure if you run "busier" databases that will benefit from faster speeds. They're small enough to dangle from USB ports.
When you go refurbished it's always luck when it comes to any type of storage. My server's root fs runs on an SSD that's like 10 years old, yet I bought second hand hard drives that are 4 years old and they were broken beyond repair.
Make sure to backup your stuff regardless.
Welcome to the club!
The build sounds good, and yes a little bit overkill. I host way more on much older gear, comfortably. For "homelab" stuff I wouldn't buy a Xeon like the other commenter said lmao, you're not going to like your bills. That's way too overkill as you're mostly likely going to be memory-bound, not CPU-bound.
Just for reference, I have ~65 containers running and using ~8 GB RAM. I started with 8 GB and added another 8 GB to have a bigger buffer, and to try out new stuff from time to time.
In general, don't worry about hardware too much, get what is within your budget to build up knowledge and skills. You will figure out what you need later down the line.
Also, I prefer Adguard Home over Pi Hole, and check out Vaultwarden, the community Rust version of Bitwarden as well.
I was going to suggest put.icu (seems like max 4GB) but their max expiry is 1 day. I found a list of privatebin instances here (it's a pastebin but you can also attach files). From the table, you can select ones with file upload, but some of them have quite low file size limit. I was able to upload a 10 MB file over at https://privatebin.at.
I'm still sad Agalloch disbanded.
I also like Dawn Ray'd, Wiegedood, Der Weg Einer Freiheit, Ulver.
I don't get it either. I'm from one of these countries that celebrate the Lunar New Year but live in the imperial core, and I've been to parties or gatherings with a mix of East asians celebrating and I don't think anyone there took issue with it being called Lunar New Year as a quick reference to the different holidays around the same time. You can phone your parents and use your own lingo then but when returning to English it really is no big deal?
I get the "Chinese" in CNY being a boogeyman thing for western whitewashed people, but personally as someone from East Asia I think Hexbear who think this is 100% a Sinophobic thing should log off and go to a new year party.
I've tried nearly every selfhosted dashboard out there and in the end settled for static html/css/js. If you want to access links quickly by typing abbreviations then use something like https://github.com/Ozencb/tilde-enhanced. A lot lighter and can be used with an existing webserver too.
https://tailscale.com/kb/1054/dns#nameservers
and
https://tailscale.com/kb/1114/pi-hole#step-3-set-your-raspberry-pi-as-your-dns-server
Set tailscale to use your dns server to resolve your services (or all traffic if you prefer). Assuming your dns server is on 100.x.x.1:53, then put 100.x.x.1 as a nameserver.
How about Uptime Kuma status pages? They're separate from the admin page and you can add Docker containers as monitors.
https://grapheneos.org/releases#changelog