Ideas what you can do. These are all SHOULD and not MUST requirements, so pick and choose what you can reasonably do in a realistic timeframe without overburdening yourself. Some of these steps can be outsourced to your community.
You can try to make a twelve factor app but some of their advice is probably not suited for your application. You will end with some 7.5factor app which is fine.
Follow SemVer and provide detailed instructions for upgrading major versions.
Use a build system which is easily installable and a language where you don’t have to upgrade dependencies every second for security issues (looking at you, npm/nodejs).
Don’t include a webserver which does HTTPS, let the people run their own reverse proxy.
Test your setup with and provide multiple web server configs for nginx, Apache2, Caddy, Traefik.
Test your setup with and provide multiple default configs for bare metal (with a dependency manager), Docker, Podman, Kubernetes, Kata Containers.
If you need a DB, include the possibility to migrate from a self contained one instance SQLite to a multi container pgsql/MySQL setup.
Write database migrations in both directions so people can downgrade on failures.
Make it possible to configure your system via ENV variables, ENV files and config files. Provide instructions on best practices and sane defaults. Explain these defaults and make clear configuration is optional.
Make it possible to disable authentication to add Authelia or LDAP through the webserver. Make clear that this is only to be used for external authentication.
Make it possible to run multiple parallel instances of your software without affecting the database consistency, e.g. for high availability or horizontal scaling.
Provide a versioned, documented API (does not need to be public) and use it yourself for your frontend. Provide a telemetry endpoint which is human readable and machine readable, so Prometheus or a similar system can scrape it.