As many others have said, not allowing inbound WAN connections into my LAN is an important step. I also run k3s on my server with Calico as the CNI and make heavy use of network policies to keep anything I’m running from misbehaving. I use OpenWRT on my router and force certain devices to run through a VPN and block other devices from the internet entirely.