Webapp security is important, but server security is in my opinion the most difficult thing to get right, ie how to configure a server properly in the era of ap

Webapp security is important, but server security is in my opinion the most difficult thing to get right, ie how to configure a server properly in the era of apps pushed directly on VPS , IAAS , containers and co . Any resources about the matter appreciated.