Opnsense firewall at perimeter…and that’s about it. Chances of anything getting in with no exposed ports is pretty slim so I don’t really bother with anything more.

For SSH exposed servers/VPS I do change the port though. Cut down log noise & maybe dodge the odd portscanner or two

Might as well if it is available.

Think it’s going to be expensive to kit of the home in a way that can actually make use of it.

…and then find a server serving anything that fast.