Yeah, in theory, Nostr is simple enough. But once you're running a client, there are plenty of valid reasons to have a backend handling WebSocket connections, proxying, caching resources, and so on.
I'm not bad-mouthing Umbrel by any means, but you might as well deploy all of this somewhere else so you don't have to worry about your BTC / lightning stuff. Docker (or better yet, Podman), Portainer (if you really need it), and open source VPNs will run pretty much anywhere. Find one of your old PCs or laptops, rent a cheap VPS, or buy some low-cost hardware, whatever works for you. Install your favourite Linux distro and off to the races you go.
I don't use Snort, but its repo has a pretty straightforward Dockerfile, so you're likely just a couple of doocker or podman commands away from running Snort locally anyway.