Some notes:
- Default MySQL install listens only on loopback interface, so isn't exposed to the network (and if it's not in your case, you can change that in my.cnf)
- IPTables/NFTables can be used to whitelist allowed network traffic beyond HTTP/HTTPS
- SSH should be limited to public-key auth, with root login disabled as well as password auth disabled (or you can use 2 step verification with Google Authenticator, which is pretty easy to set up)
One thing I'll note is that I don't have Tomcat exposed directly to the internet: it's only exposed through an NGINX reverse proxy.
Apache Tomcat is fairly easy to download and set up (you can download the .tar.gz from Apache's website, untar, and run the executable ./bin/startup.sh).
I'd be happy to answer any questions really re: Java/Spring