Well done on getting it up and running, federation seems to be working moplemmy.fyi/instances & phiresky.github.io/lemmy-federation-state/site?do…
You shouldn’t have to put instances in the Allowed Instances, just use blocked list for stuff you dont want to see
Yes email is a pain in the arse. More so if you are having to deal with dynamic IPs
Now just wait for the scrapers to turn up. Both Dave (lemmy.nz) and I are getting well in excess of 500k requests from content scrapers per day atm and they are tyring to pull in whole comment trees and walk through all posters.
Have a look at Iocaine to help tarpit some of them if you dont want to route through something like cloudflare.