So, finally, i switched from iptables to nftables, wrote a (supposedly) good firewall config and allowed only specific ports for incoming traffic, wrote a utility to generate a blocked subnets list from ASNs.

Next todo item is a fail2ban alternative.

Also, i'd like to write a backend for my captcha with dynamic javascript obfuscation and dynamic challenge tokens. That's a low-priority task (but rather very interesting to implement). I need to migrate to another hosting first.