There is not actually much to do with respect to securing web servers. For the most part, you're at the mercy of their code and you really shouldn't try to mess

There is not actually much to do with respect to securing web servers. For the most part, you're at the mercy of their code and you really shouldn't try to mess with it or you are probably making things worse. As far as securely configuring them, that's maybe 2 pages worth of material and should be in their respective manuals. Beyond that, your options are standard host hardening and network segmentation. I actually don't think that is really covered in any of these. Securing the web application running on those servers, however, is a book worth of material. All of these are too old for any mention of nodejs, but Web Application Hackers Handbook will have some generic web attack coverage.