Quick straw poll...

I used (virtualised instances of) OPNsense in a recent project because in this particular case I really needed a GUI, but if I have to do something more ad-hoc and/or complex (network namespaces, policy routing, complex firewall rules, remote logging of the conntrack table with ulogd2, BGP/OSPF, VPN setups, etc. etc.) I generally deploy a standard Linux distro.

With a limited amount of systemd drop-in files it doesn't take too much work to set up a system where every config file somebody may want to change is collected in a git-managed directory and a couple of scripts that call git and systemctl restart/renew are all that's needed to switch to a new configuration.