content: It's just for me, but does have it's own firewall, fail2ban, https + reCaptcha for the web services. Public-facing services like ssh, https, smtp/imap and dns are naturally exposed but monitored by fail2ban and encrypted (ssl/tls). All other services only listen on loopback. I would definitely  tighten it up a bit if this was a public service though.