I’m skeptical of “no ssh” being a benefit. I’d rather have one port opened to the battle tested ssh proc (which I probably have already anyway), than open a port to some random application.

I suppose it’s trivial to proxy a http port over ssh though so that would seem like a good solution