Been running my own server for 15 years. I need to put about 20 hours maintenance a year in for updates. I have the whole thing automated as a helm chart using PVCs with cert-manager for auto-renewal and the node just runs k3s as a single node.
That's a lot of extra layers, but the layer of seperation between the host and the services makes it very easy to automate all the pain away.