I host Psono and auth via OIDC provided by Authentik.

I chose Psono because it was the only option that offered OIDC on a free tier. Previously I paid for Passbolt which wasn’t bad, but Psono does the same job for free and is nicer to use.

Why can’t you have your TLS managed at the gateway, then reverse proxy based on subdomain to your various services?

Portainer stores its own version of compose files in a specific place. I believe you can just copy your compose files into that place.

IRC doesn’t enforce authentication or encryption. That’s why it doesn’t rate a mention in any conversation that includes Matrix.