You could also route any calls to /api through authentication. However I am not sure if that can cause any problems. Is there a list of endpoints that need to be reachable for federation to work?
Never noticed anything in the last couple of weeks. I had one podcast missing new episodes because the schedule was turned off. But I might not have had it turned on in the first place.
You can also check out 2FAS, which recently got open-sourced. It comes with browser plugins to autofill 2FA pushed from the phone on request. Makes it a lot more convenient if you need another reason to switch.
If it is just for email forwarding maybe a service like https://anonaddy.com/ or https://simplelogin.io would work. Catch-all is even included in the anonaddy free plan as that is something you actually do not want to have enabled 😄 For your custom domain you have to have the lite plan at least though.
You could also route any calls to /api through authentication. However I am not sure if that can cause any problems. Is there a list of endpoints that need to be reachable for federation to work?