I'm running my mail server on Arch Linux since 2011 (so since Arch was in its quite early days) and I applied principles outlined within CISSP. Particularly I was focusing on reducing plane of attack to absolute minimum, ensuring I know exactly what each config option results in and keeping my server up to date. This has served me well and let me go through more than a decade.

I see some posters saying it's not good practice to run Arch, but I think distro alone is not an answer to your security concerns.

Im curious: Why are you running a fake HTTP server? To slow down bots for a while or does it serve a higher purpose?

Slow down bots, and to see what garbage they're sending. I keep track of POST data and HTTP headers.

I'm on CenturyLink fiber, they are apparently so incompetent they can't take my money for a static IP address, so whoever is doing HTTP requests is blindly trolling CenturyLink residential IPv4 blocks. Nobody doing this is up to anything legit.

I was running this on my laptop for a while but it doesn't support hibernation which sucks :(

Try linux-zen. I run it on Dell laptops, and it seems to support hibernation. Unless I'm not calling it the right thing.

Why aren't linux-hardened's options the default and patches, if any, upstreamed?