Install only software that you use and prefer minimal installations. (Debian has good defaults) Then you can install the unattended-upgrades package and when using ssh don't setup a password but use ssh keys. Also ufw needs to be enabled and then you can use nmap to scan for open tcp and udp ports. (Of course it's also possible to filter outgoing connections, by default only the package servers need to be accessed)

If you install services like email or http prefer software with a small footprint and with few CVEs in the past. Since http services are quite common, it's advisable to put a reverse proxy in front. Separate users for separate services is also a good idea.

Never had any issues with that kind of setup. Of course it's possible to add additional hardening like using an ssh jump host or a VPN to access ssh. (Probably advisable if you plan to put private data on it) Also using SELinux is an option, Fedora has it by default.