This list is very useful. With whitelisting for federation and a few mod_evasive and mod_qos rules (or Fail2ban) in place, running Friendica usually works fine security-wise. If that's not enough, the next step would be putting this kind of reverse proxy in front of it.