My approach so far is just run tailscale (or some other VPN) and dont serve stuff on the public internet. Your response is typical of what happens when regular

My approach so far is just run tailscale (or some other VPN) and dont serve stuff on the public internet. Your response is typical of what happens when regular people ask this question - see an insane number of suggestions and best-practices and promptly give up.. The amount you invest in security should be proportional to the consequences you incur in case of a breach. For someone just starting out, don't put anything too sensitive on the server, do the simplest security steps you know how to do and get started. You can scale up the security to insane paranoid nation state levels if/when the consequence of a breach is bad enough to warrant it.