Starting `pf` Firewall at System Startup
You shouldn't have to create your own plist to enable the pf firewall on boot especially since you're using the default rule set.  You just need to enable it.  This will launch at the &quot;correct time&quot; when all of your interfaces are configured and up.
Step 1:  Edit the Apple supplied plist
The file you're looking for is  /System/Library/LaunchDaemons/com.apple.pfctl.plist.
Change the Disabled key from &quot;true&quot; to &quot;false&quot;.  Here's what it should look like:
&lt;!DOCTYPE plist PUBLIC &quot;-//Apple//DTD PLIST 1.0//EN&quot; &quot;http://www.apple.com/DTDs/PropertyList-1.0.dtd&quot;&gt;
&lt;plist version=&quot;1.0&quot;&gt;
&lt;dict&gt;
    &lt;key&gt;Disabled&lt;/key&gt;
    &lt;false/&gt;
    &lt;key&gt;Label&lt;/key&gt;
    &lt;string&gt;com.apple.pfctl&lt;/string&gt;
    &lt;key&gt;WorkingDirectory&lt;/key&gt;
    &lt;string&gt;/var/run&lt;/string&gt;
    &lt;key&gt;Program&lt;/key&gt;
    &lt;string&gt;/sbin/pfctl&lt;/string&gt;
    &lt;key&gt;ProgramArguments&lt;/key&gt;
    &lt;array&gt;
        &lt;string&gt;pfctl&lt;/string&gt;
        &lt;string&gt;-f&lt;/string&gt;
        &lt;string&gt;/etc/pf.conf&lt;/string&gt;
    &lt;/array&gt;
    &lt;key&gt;RunAtLoad&lt;/key&gt;
    &lt;true/&gt;
&lt;/dict&gt;
&lt;/plist&gt;

Step 2:  Load (or reload) the plist with launchctl
% sudo launchctl load /System/Library/LaunchDaemons/com.apple.pfctl.plist

Step 3:  Firewall should be enabled upon boot.

My recommendation...
You should not expose the Mac (or any server) directly to the Internet but instead, it should be behind a firewall box/appliance!
Don't get me wrong - I am a huge fan of pf.  You should still enable the pf firewall on the Mac.   However, if what you're saying is correct that even for a couple seconds you get slammed with DDoS attacks, the (Mac) server shouldn't be dealing with them; your firewall should.  In fact, you should have a proper pfSense firewall in front of this server.  By having a separate firewall, the Mac will always be protected regardless of its status (i.e. an inadvertent rule change mistakenly opens it up).
You also gain the advantage of being able to run packages like pfBlocker-NG on the appliance (will drop connections from known bad actors based on black/white lists) giving you a higher level of protection.  Having it on the appliance frees up your Mac from having to handle those processes.