For my personal servers/services? Everything behind an OpnSense and only accessible via VPN. There is one service on HTTPS a friend has to access, that got a ng

For my personal servers/services? Everything behind an OpnSense and only accessible via VPN. There is one service on HTTPS a friend has to access, that got a nginx as reverse proxy with http basic auth & long random password in front of it. This reduces my attack surface to "people on my network or VPN", which is further segmented in VLANs. The OpnSense firewalls between VLANs, and especially the IoT crap & my VPN only have very limited access. I HTTPS all the things except the Tasmota UIs. I use a SmallStep CA with ACME on my internal network to get certs for my internal stuff; to be safe, the root cert is NameConstrain'ed to `.lan`. Obviously everything is in my local DNS. If someone steals that approach: Make sure to put DHCP-assigned DNS names into something like `.dhcp.lan` ;-) As you can see, this is already quite opinionated. Generally: Be minimal with what you expose, make sure to quickly update, setup SELinux, setup proper firewalls/VLANs for multi-host deployments. SSH only with keys, not with passwords. Compartmentalize, so that one breach doesn't pwn your machine(s). For that you need either more physical machines, or you can put stuff in containers (I prefer root-less podman over docker) or VMs (e.g. libvirt/qemu or ESXi). Also, don't rely on some Ubuntu LTS to get all updates you need for "a long time". E.g. Tomcat is a community package and the 18.04 LTS was missing many (security) updates last time I've checked. I've also seen docker containers not being timely updated by their maintainers. Do some external port scans to not be surprised that you e.g. accidentially left your SQL open for the world. Because mistakes happen, and a `nmap -T5 -p1-65535 $host` doesn't hurt you.