And cloudflare tunnel which allows you to block even ports 80 and 443. The only attack vector is then through ssh but with passwords disabled I wouldn't worry too much about that.