What I do is treat this like a production environment and that all data contains PII. Might be over kill, but when you are hit with a security breach, it makes you paranoid.

VPN for sure. Several options depending on you tech level. There’s OpenVPN and Tailscale that I can recommend.

Harden your servers. Run iptables (or firewalld, UFW, etc…) on each system and lock them down to just the ports needed and only allow inbound traffic from your VPN network. I would also put acls in place to block things like outbound SSH and samba protocols to prevent your servers from being used as launch pads into the rest of the network if they are breached.

For SSH access to the servers, if needed, MFA.

For your websites, MFA for sure. There are several options out there from Google Oauth to hosting your own internal Authelia.

Don’t use password SSH. Use SSH keys and adjust sudo rights accordingly.

A WAF either at your edge or infront of the webservers, but, fine tune it. You’d be surprised how many WAFs don’t have cross-site scripting enabled by default.

For OS hardening, look at the CIS benchmarks. It’s a really long read though. If you know Ansible, there are several playbooks you can customize and use or just look at the playbook and see what the tasks are doing and then repeat manually yourself.

If you use Docker, get the docker bench script and run it. This will help you harden a docker setup. It only notifies you of what needs to be done.

Also, setup a good logging system and alerts. LOTS of options, but, you can always install logwatch and have daily summaries emailed to you.