The ultimate bad bot blocker (https://github.com/mitchellkrogza/nginx-ultimate-bad-bot-blocker) does the heavy lifting for me, it updates multiple times per day to add and remove IP addreses and bot referers. It does need some monitoring though, some of the rules wildcard a bit hard and will catch mastadon servers with unusual names for example.

Every machine is named after what it does (although I do 1337-ify the names, because I’m still a late 90s IRC teen at heart). If you’ve ever been onboarded into a sysadmin role where all the machines are named with whatever whimsical naming scheme each department chose, you’ll fast develop a visceral hatred for non-descriptive naming schemes. The fifth time you get a ticket saying something like ‘Hedwig is down’ and you have to go crawling through three layers of linked files on SharePoint to find what and where ‘Hedwig’ is, you’ll be ready to beat the person who named it to death, and that attitude tends to persist to your home naming scheme :p