This morning a couple of postings on Craft Slack #devops area linked good descriptions of basic server security, led by @merlingore there.
Their instructions are tilted towards Ubuntu as far as specifics, but should fit for any Linux VPS.
Recording the links here so we don't lose the patterns. I agree with them because they're actually the same as what I came up with personally in arranging VPS security, and they say what's needed clearly and concisely.
and to complete on automatic security updates,
IT's quite worth reading the comments also on each of these, particularly the second. I like the so-often Germanic completeness there, if would suggest that auto-reboot is not just for personal servers.
You can control time-of-day via the auto-cron setting, and if you need 100% uptime, this is very likely better managed (and likely only actually possible for many scenarios) by providing more than one load-balanced server, updating them in a sequence, which again the cron portion could be one way of handling.