>should I use PSAD or CrowdSec?

Use a free solution, never used these. Are they even current?

  -ssh is a way to access the server (pub key is preferred way)
  -ufw is a frontend to iptables
  -fail2ban blocks based on regex rules. (needs tweaking)

For web, you'll need port 80, 443 open, and a port for ssh, default is 22. I would change ssh port to something higher as there are many bots that scan all of these known ports.

Monitor your logs, and check for activity. access.log, syslog etc.