JASN_DE

Probably simply not a lucrative target for automated scanning/attacks, unlike e.g. ssh.

Edit: or WordPress. My logs are full of those, until Crowdsec hits.

The RSS feed is still fetched from their server. Whoever can watch your internet traffic would still see the connection to the site.

Irrelevant, as that data can simply be retrieved inside HA.

I’d up the RAM to whatever your budget allows. 8GB are on the low side for several heavy services at the same time.