Make it maintainable.
Documentation. Or implicit documentation with ansible or the like (opentofu).
Separate things with LXCs or VMs or OSI containers. Maybe firewalls (ufw) and VLANs to separate them. Incus is nice. As someone already said: Leave the host system mostly vanilla. Services go in the virtual boxes and containers.
Btw: Nix looks promising, too. But I have not opened that can of worms, yet.
Backups...
Automation. unattended-upgrades, watchtower(unmaintained) or the like. So you don't have to do it yourself and then forget about it. Claude is looming on the horizon. It will bring many bugs to light and code the exploit for it in no time if someone asks for it nicely.