After setting up HTTPS, always being updated, introduce port knocking for HTTPS port : https://www.digitalocean.com/community/tutorials/how-to-use-port-knocking

After setting up HTTPS, always being updated, introduce port knocking for HTTPS port : https://www.digitalocean.com/community/tutorials/how-to-use-port-knocking-to-hide-your-ssh-daemon-from-attackers-on-ubuntu https://www.digitalocean.com/community/tutorials/how-to-use-... Its less of a hassle to use something like nginx reverse proxy docker container in front of your web services, as it comes preconfigured with some best practices regarding TLS. (TLS1.2+ only by default) https://hub.docker.com/r/jwilder/nginx-proxy https://hub.docker.com/r/jwilder/nginx-proxy If you use docker, be sure to google around how to manage firewall with containers (must use DOCKER-USER chain instead of INPUT) Ofcourse, you will get a bit involved in setup step if you choose to tie nginx proxy, letsenccrypt and nextcloud containers. But search engine is your friend.