Ask HN: Best practices securing Linux (arch) on a x1 extreme gen 2?

Finally got it delivered! It’s been a while since I dig into a personal use case for Linux. I’m opting for arch. I searched relentlessly and I don’t see recommended best practices that have convergence outside the basic root user 101. I’m looking for: 1. Ext4 fs still the best with ssd and nvme? 2. Good bang for buck disk encryption solution? 3. Way to utilize TPM for automatic key management and possible disk encryption? 4. Fingerprint reader use case? Those are the biggest unknowns for me while digging all the wiki docs and blogs around right now. Also if you have a must have I’d love to hear it! Thanks ahead of time.