Run Tailscale on your server, bind the ssh port to the Tailscale local address only, then you can just logon to Tailscale to access SSH, no longer publicly accessible.