I think Yunohost integrates fail2ban, too.

I was under the impression “air-gap” doesn’t apply to browsers, as you’d need to not have an outside internet connection.