I ended up going with Crowdsec.
The setup was a bit of a challenge as I like to do it the RTFM way abd that there is a bunch of concepts to grasp before you really understand what you are doing, but since then it's been working pretty great ! And it's free (as in you are providing them with data on the occurence of threats etc, so you don't pay)
When the bubble pops or deflates, it'd be lowkey funny to see them go : "Heyyyy ! Remember me ? Good old Crucial ? I'm back on the consumer market !"