@Natanox The reverse proxy is if you use web apps, to expose and redirect 443 to specific ports on the server. Depending on your case of administration (if you need GUI), this can be useful.

My server is also under arch, but docker allows me to minimize the impact of an upgrade problem on the host OS side.

Otherwise I agree, ssh through the VPN client to server is better, whether it's with openVPN or Wireguard

@Natanox any distro, maybe stable and use docker rootless / podman + reverse proxy + wireguard. Dont forget, disable root + his shell (for escalation blocking). Add a strict restrictive firewall policy to ensure maximum security.

Use owasp guide for OCI hardening