

I would reconsider docker because if a specific application leaks some sort of shell access or system file access you’ll be protected out side of container host escalation.
Unrelated to security, I prefer docker because it leaves the server very clean if you remove different apps. Can also save time configuring more complex applications or applications that conflict with system libraries.
Add fail2ban on your list of applications it watches logs for invalid logins and puts them on firewall block rules after so many failed attempts.
It’s been reasonably active here definitely not reddit in it’s prime, I haven’t found it worthwhile to self host lemmy but others may chime in that do. I’ve got a few other things I’m hosting on my Dell r720xd matrix, jellyfin, wireguard, next cloud, gonic and other minor things.