I run the itzg Docker Image behind a Wireguard VPN, all hosted on an embedded board (a armbian powered Radxa 12L with 16 GB Ram).

So far so good, we have an offline server, so even if the Microsoft Server is down, we can play (we use PolyMC on PC with offline accounts as well, for the same reason). By default, new users are in "spectator" mode, so they can't do anything without an activation from admin.

Friends get Wireguard QR codes, periodically we rotate them.