You could put it behind a Wireguard VPN. That way you aren't exposing SSH or the like directly on the internet. Properly-configured SSH with public key authentication is not something I worry about though.