Software:
- firewall, no inbound and do outbound restrictions
- use immutable OS
- full disk encryption (keep in mind that in many setups you will need to be beside the computer after restart)
Hardware:
- put it in the trusted datacenter (home stuff is not safe from teenagers and people that need computer's electrical socket for a vacuum cleaner)
Thank you, integration with activitypub is what i was after!