When I looked at OpenSnitch (years ago), it didn't support running headless on a server. Am I mistaken about this, or has it changed?

You can run daemons on several nodes (different machines) and view them all through a central ui, it is pretty cool.

The UI is a separate package. Though you might just configure the firewall yourself at that point.