The basics for anything:

• ssh key access only
• and a hardware key if available
• disabled root
• fail2ban
• rate limiting
• unattended upgrades
• calendar reminder to run full updates

After that, it really depends on what you’re running and who needs access where.

If it’s just you, or a small group of devices that you have access to and can maintain, Tailscale is the easiest best first step, or your own headscale server.