Securing/Hardening a server

[leamsifigs]

What are some steps I can take to harden my pi which faces the internet? I've done a decent amount of the actions mentioned in this DigitalOcean article, but now running a PiVPN instance, i'm not sure what would conflict. Any pointers on where to keep looking or anything that would directly conflict with PiVPN?

[coolapso]

not much with the respect to the vpn itself ... pivpn sets up sane defaults on the protocols.

you can close ssh from the public ip and allow it only from the VPN network IP . however you risk loosing access to the server in case the VPN protocol stops working for some reason. If you have some sort of kvm console access its not too bad of a risk.

[orazioedoardo]

however you risk loosing access to the server in case the VPN protocol stops working for some reason

I think it's worth the risk if it is for personal use. WireGuard kernel support has been solid for many years, OpenVPN can be run in parallel with PiVPN. Optionally can run one and use systemd OnFailure= option to start the other if the main VPN fails.