I'd recommend an OpenBSD-based setup given 0-days, lack of security tech, and bad configuration are top methods of attackers. That team is way ahead of the rest in auditing for and preventing such problems in every area. Plus, unlike stronger architectures, it's available to you free and ready to go.