"Nice website you have running on your own hardware.
It would be a shame if it was DDoSed from the cloud."
-A proxy, e.g. Cloudflare
- A fat link, e.g. 100Gbps Cogent + a good hardware firewall (completely independent scenario)
- Use a GPRE tunnel based mitigation, if you own your own AS number, e.g. by Verisignie. "you can pay the muggers or build yourself a castle with a drawbridge"