Yeah I thought about this problem. I don’t want to lock down all ports for nginx, but instead only certain websites through nginx rules.
The webhook receiver would remain open to the public, but would require a long passphrase that would result in ban through fail2ban, if entered incorrectly.

I know this isn’t ideal, but that’s what I had in mind, when thinking about the problem.