2-2-1 still insinuates having a remote backup. I don’t see how this particular threat destroys a 2-2-1 setup.

I have been utilizing BunkerWeb for some of my selfhost sites since it was bunkerized-nginx. It is indeed powerful and flexible, allowing multi-site proxying, hosting while allowing semi-flexible per-site security tweaks (some security options are forcibly global still, a limitation).

I use it on podman myself, and while it is generally great for having OWasp CRS, general traffic filtering targets and more built on top of nginx in a Docker container, the way Bunkerweb needs to be run hasn’t really remained stable between versions. Throughout several version upgrades, there have been be severe breaking changes that will require reading the setup documentation again to get the new version functional.

There are not many Android phones that actually let you flex the open source benefits of AOSP. Android as it is packaged on many devices is not open source, and nor are the devices willing to fully let you install what you want. Ironically some of the only choices you have with the highest degree of freedom are from google.