I noticed by default the appliance doesn’t have a firewall (iptables/ufw/firewalld) installed so I installed UFW with the update it wipes it away (which is known), but if my appliance is public facing is the firewall even needed? Are there any services exposed that shouldn’t be without a firewall?
Yeah, only the necessary services are runnning. You can disable samba (Windows file sharing) in Settings → System (or enable/disable SSH there).
For extra installs you can use
touch /var/urbackup/post-system-update.local
chmod +x /var/urbackup/post-system-update.local
and put the installs into /var/urbackup/post-system-update.local.
OK, awesome, thank you so much.