i try to keep it secure by minimalism because the less complicated is the software the smaller is the chance of a vulnerability
so everything related to file transfer/access uses sftp (with accounts with no ssh permissions because: 1. i dont want the password to my server to be stored anywhere in some sftp software 2. im not the only user of this server) and for other services i just run a small local program and remote access it with ssh
i guess the biggest secuity threat is someone physically stealing the backup disk or the main hard drive because theyre both unencrypted



my only physical console option is composite video (its an rpi) connected to a crt (luckily the server is close to the crt so i dont have to move 16kg of leaded glass every time i want gui server access)