A 17-step checklist with copy-paste configs. Firewall, SSH, fail2ban, HTTPS, key rotation. Make sure yours isn't one of the 135,000+ exposed.