IMO, a Pi running off a MicroSD card is by far the highest failure risk you have in this configuration. Most modern spinning disks are more than capable of being a backup workhorse, while MicroSD cards feel like a crapshoot.

For backups, I’m a fan of pretty much anything new from Seagate or WD (failure rates are minimally different), though you can also check Backblaze’s quarterly reports if you want to get specific.

My other go-to is just used enterprise HDDs (usually SAS for my configuration, but SATA is there too) since such drives often come with very low write life used, and generally incorporate features that make for an extremely high MTBF. Though it’s obviously hit or miss if you get a drive that was barely used or a drive that was beaten to death. Good eBay sellers usually are pretty good about these things though.

In either case, you’ll need an enclosure (obviously if buying new, you can just buy one with the enclosure).

DNS over HTTPS, DNS over TLS

I ran this way forever. I also did this but with kube. Works super well, you can pass through any hardware you need (GPU for Plex, for example). It also allows you to control allocation of resources if you’ve got other things on the server and don’t want Docker running wild for any reason (transcoding Plex, for example).