Ask HN: Guide to making a Linux or BSD web server secure?

Context: a public-facing web server hosted through a cloud service provider running a dynamic website or SaaS app.

There are lots of guides online, but often the details differ. For example, a recommendation to create a disk partition to separate OS files from non-OS files can be found in some guides, but not mentioned in other guides.

What are your recommended guides? They can be links, books or courses.

Also, opinions on Linux vs BSD when choosing a web server OS are appreciated (without any flame wars :-)