I do that but also allow sync when not on local network - via traefik and such as a reverse proxy. However ... I may still turn that off as I have wireguard on

I do that but also allow sync when not on local network - via traefik and such as a reverse proxy. However ... I may still turn that off as I have wireguard on everything anyway, so it's super simple to turn wireguard on, sync "locally" and then turn wireguard off.