Rootful Podman & podman-compose. Waiting on the version of Podman that supports passt to hit Debian Bookworm or backports to attempt rootless. Deployed with Ansible except a few manual parts like creating the Postgres databases themselves.
No auto updates or notifications so far, as there seems to be a couple incompatibility issues left with Watchtower & Podman. Although since I switched CrowdSec to monitor journald instead of the Podman socket I don't really have a reason to keep the daemon running, and I think that's for the best.
Microservices aren't a silver bullet. There's likely quite a lot that can be done until we need to split some parts out, and once that happens I expect that federation would be the thing to split out as that's one of the more "active" parts of the app compared to logins and whatnot.