I use it for all of my external services. It's just wireguard and traefik under the hood. I have no familiarity with bunkerweb, but pangolin integrates with crowdsec. Specifically it comes out of the box with traefik bouncer, but it is relatively straightforward to add the crowdsec firewall bouncer on the host machine which I have found to be adequate for my needs.
I cannot recommend The Dog Stars (https://app.thestorygraph.com/books/dbff7c12-aff3-4b55-ae20-9b2d0051c92d) enough. It has a peculiar style to it and, admittedly, it took me a couple starts until I got hooked. I am so glad I stuck with it. A very literary post-apocalyptic fiction story with more action than Station Eleven, but a similarly compelling character study.
Have you considered running Wireguard or Headscale instead of keeping SSH open? I don't know how big an issue it is since you've changed the SSH port and use keys, but opening SSH in any respect freaks me out.
They say it's the breast, but they're likely not fans of the motto either.