Repositionning of the fail2ban configuration with nftables from wireguard to ext_srv as all servers exposed to the outside should be protected as well. Also minor cosmetic changes and light reordering.