Prevent password logins where ever possible too, especially SSH. Use ed25519 keys. Perform server actions with least privilege users, prevent root logins. Immutable systems and containers are a helpful tool too.
I also just host my public facing stuff on a VPS. DDOS protection and just otherwise isolated. 2FA on the VPS too.