Clean unused/disabled snap packages

snap list --all | while read snapname ver rev trk pub notes; do if [[ $notes = *disabled* ]]; then snap remove "$snapname" --revision="$rev"; fi; done

Restrict to single host, e.g. for prometheus node exporter

iptables -N prometheus  
iptables -A prometheus --src <server-ip> -j ACCEPT
iptables -A prometheus -j DROP
iptables -I INPUT -m tcp -p tcp --dport 9100 -j prometheus