So after a while ended up with:
Repository("stangri_repo_", "https://repo.openwrt.melmac.net", { priority = 60, ocsp = false })
Install("pbr-iptables", { priority = 60, repository = "stangri_repo_" })
Inspiration from the Tailscale package solution basically (GH here - .lua and readme) from this thread
After reboot the update (pkgupdate or in reForis UI) is done with no errors so maybe it’s OK.
Not sure if should remove entry from customfeeds.conf or if this only add for repo the priority.
To distinguish the customfeeds.conf vs this one in user.lua - added ‘_’ for the name. So hopefully if there’s a catch will se which one is in conflict.
Not sure how secure it is: ocsp = false, no verification from options working for me (don’t know how to properly configure it tbh).
The actual up-to-date documentation I used for verification settings, referenced in example.lua, is here.