Fun little project. Well done.

Giving a public facing application sudo powers (even limited ones) is a little scarey. If I understood your documentation I believe if I somehow got onto your box I could escalate to root just by editing your iptables scripts. You probably want to ensure www-data (or anyone) cannot write to these files :-)