If your idea of the greatest country is one in which you can and probably will be imprisoned through no fault if your own, forced to perform manual labor until it kills you, and if you somehow survive long enough to be released, systematically impoverished in order to force you to steal to survive and thus ensure that you end up back in prison, then I have to wonder what you think goes on in the rest of the world.
Make no mistake, this country is extremely cruel. Living here is terrifying, and I’m not even black.
My go-to backup strategy is USB hard drives. They’re cheap, they’re fast, and nobody’s going to even try to decrypt them. Buy several, put them in a safety deposit box at your bank, rotate them weekly, and nothing short of a nuclear weapon will destroy every copy of your data at the same time.
Disable password authentication and allow only key/certificate/token/etc wherever feasible. Don’t even ask for a password if some other authentication mechanism can be used instead. Human-memorized passwords are weak and generated passwords are a poor substitute for proper cryptographic key exchange.
su, sudo, and Polkit are privilege escalations waiting to happen. Remove them if possible; deprivilege them (remove the setuid bit) if not. Do not allow any means for an unprivileged user to get a root shell, regardless of authentication, because unprivileged accounts may be backdoored and letting them elevate will grant root privileges to the attacker as well.
On your local machine, always log in as root on a separate virtual console using a separate password. On remote machines, always log in as root using an ssh key only accessible to the root account on your local machine.
I’m iffy about hiding SSH behind a VPN. Doing this creates a serious risk of being locked out of your own server, and if your SSH server is configured correctly (as described above), then the security benefits aren’t that big. If you do find the risks acceptable, feel free to do this, but you shouldn’t feel obligated.
Docker is unnecessary complexity and overhead. Use systemd to isolate things; it can do things like filtering system calls and hiding portions of the file system. SELinux might be good too, if you can figure out how to use it (I never could).
Fail2ban is unnecessary if nothing accepts passwords for authentication. There are no fails to ban.