Best Practices for Configuring UFW and Fail2Ban on an Ubuntu Nginx Server Hosting a Static Hidden Service

I have a hidden service serving static HTML on Ubuntu with Nginx. I installed UFW and Fail2Ban on my server.

My question is: Is it a good idea to use both? If so, what are the best UFW settings .. specifically, which ports should I open or block?

Also, what configuration should I add to the Fail2Ban settings file (sudo nano /etc/fail2ban/jail.local)?

i did this but i think it's wrong !

sudo ufw default deny incoming

sudo ufw default deny outgoing

sudo ufw allow in on lo

sudo ufw allow out on lo

sudo ufw allow out to 127.0.0.1 port 9050 proto tcp

and

[DEFAULT]

# Ban hosts for one hour:

bantime = 1h

# Check every 10 minutes:

findtime = 10m

# If there are 3 attempts in 10 minutes, ban the IP:

maxretry = 3

# Define the log level and log target

loglevel = INFO

logtarget = /var/log/fail2ban.log

[nginx-tor]

enabled = true

port = http,https

filter = nginx-tor

logpath = /var/log/nginx/access.log

maxretry = 3

[nginx-connect]

enabled = true

port = http,https

filter = nginx-connect

logpath = /var/log/nginx/access.log

maxretry = 10

bantime = 3600

In my opinion, fail2ban is over kill in this situation. because you are serving a static website on Tor. There are methods which you can use to completely seal the server (ports, SSH, etc) by just using UFW. I have a guide on how to set up websites on the Tor anonymity network, I can send it to you if you want.

yes plz