This assumes root is logged in via SSH to the latest Ubuntu server, with the root SSH authorized keys stored in /root/authorized_keys
.
Another assumption is that you use postgres and redis hosted on different database servers, so we don't install those on the app server.
Edit the SSH config and disable password login. Update the SSH port to something random.
vim /etc/ssh/sshd_config
systemctl reload sshd