What sort of stuff do you do to make sure those are services hardened? And what kinds of services? I've been meaning to create such a setup, but am a bit concer

What sort of stuff do you do to make sure those are services hardened? And what kinds of services? I've been meaning to create such a setup, but am a bit concerned about vulnerabilities.