I would say there are better methods to solve this problem these days than a script. Check out Ansible or NixOS.

Put your external facing services behind the VPN, or at least put them in a separate VLAN that’s firewalled in such a way that they can’t reach the rest of the network if they become compromised.

For the last question I welcome you to !skincareaddiction@sh.itjust.works where’s there’s a lot of helpful people that can help you with that! 😊