I’m probably in minority here. My setup is simple, I chose a good OS like Debian or Alpine to run things on, make sure it’s always patched, move sshd to a nonstandard port and harden it.