For this new server I've decided to part ways with `ufw` in favor of `nftables`.
First impression is that I really like the compartmentalized firewall logic across `*.nft` files. Also, it's nice not having to setup `ufw-docker` now that I'm running rootless podman containers. I'm still sticking to always publishing container ports to `127.0.0.1` or the Wireguard interface.
That said, I'm looking forward to using socket activation to do away with ports altogether in some containers.