Eh, honestly, if you're not running anything else on the box, you probably don't have to be overly proactive about maintaining it. Sandstorm handles updating its own dependencies and mitigating most kernel bugs. Maybe if you're leaving sshd open to the internet that's something to worry about, although if you read HN you'll surely know when that needs patching. :)
That said, we plan to build a "Sandstorm OS" that auto-updates everything including the kernel, and doesn't even have an SSH interface (wouldn't be useful anyway).
That being said, to roll your own you'll need to run a box somewhere, select secure defaults, and keep on top of patching the box itself. It's not worth it unless you're really willing to spend the time to do it correctly.