Oh man I didn’t see your reply on Snort, wound up using a Debian VM with Umbrel installed (had additional benefits like de facto split tunneling from the host now that Mullvad VPN disabled port forwarding).

But I’ll join to keep tabs and support. :)