i'm quite pleased with my VPS setup... it only has public access via the reverse proxy on 80/443 and some arbitrary port number in the 5 digits that is my wireguard, and that's the only way to get to the SSH, so i never have logs full of login attempts, no key, no workee