The gist is, yes, that really is all there is to it. Setup unattended upgrades for your distro of choice, setup fail2ban, only make internet accessible the por

The gist is, yes, that really is all there is to it. Setup unattended upgrades for your distro of choice, setup fail2ban, only make internet accessible the ports you need, upgrade out of date software (i.e., don't fall behind LTS). Make sure your software behaves with good security practices (don't trust user input, etc). Any modern guide these days should just about cover it. For more complex deployments you'll enter the world of reverse proxies, custom VLANs, automation abstraction, intrusion detection systems (i.e., applications that proactively monitor access logs for suspicious activity), logging systems, alerting systems... But for simple app deployments, getting a reasonably secure system setup is actually not that hard. Maintaining it and keeping it secure is another matter (keep private keys secret, don't use simple passwords for SSH, etc), dealing with large upgrades, don't deploy debug to prod...