Look at previous hacks. Un-patched packages and services, bad passwords, unexpected privileges. Only allow in the service port to minimize your attack surface.

Look at previous hacks. Un-patched packages and services, bad passwords, unexpected privileges. Only allow in the service port to minimize your attack surface. Automatic security updates. WAF if you can. Cloudflare has a free tier with WAF. Maybe deploy a SIEM so you can alert on unexpected behavior.