My usual additions:

1. Have the router to block portscanners
2. fail2ban on internet facing services.

Networking looks fine, but check fail2ban as the other commenter mentioned, it goes to the npm.

Make sure to keep all internet facing applications up to date and use strong passwords.

Am I missing anything here or is this how I’m supposed to be doing it?

AFA fail2ban, I always set up the jails in aggressive mode:

[sshd]
mode = aggressive
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 5 <---edit to tastes
bantime = 3600 <---edit to tastes
findtime = 600 <---edit to tastes

You might want to check out Crowdsec, maybe deploy Tailscale as an overlay. How many users are you providing services for? If just yourself, I use the host allow / host deny feature in Linux. Just make sure you do host allow first, lol.

I'd add Crowdsec

Safety is relative. How are you handling every hacker in the world knocking on your door?

Personally I only expose a VPN and use that, instead of exposing a bunch of services.

If any service has only username and password instead of mfa or password less then it’s not safe.

You also didn’t mention if you have automated patching or immutable backups enabled.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

4 acronyms in this thread; the most compressed thread commented on today has 13 acronyms.

[Thread #71 for this comm, first seen 7th Feb 2026, 20:10] [FAQ] [Full list] [Contact] [Source code]

You're good in that there are no immediate problems with that setup. I run a largely similar setup, have run it for years, and have never had issues.

You can always add more security layers if desired, but from my personal experience and with my risk tolerance, I haven't personally found it necessary.

Always risky to be exposed to the internet. unless you can't, you should look into using tailscale/netbird to keep everything within a VPN.