Selfhosted

This is mostly nonsense.

• Why block outgoing? Its just going to cause issues for most people. If you're going to do that, do it centrally (hw firewall)
• Why allow http and NTP incoming, when there is no http / NTP server running.
• If there is http server running no mention of https://ssl-config.mozilla.org/ and modsecurity
• If you're using ufw anyway why not go with applications instead of ports?
• In a modern distro, the defaults are usually sane (maybe except TCP), most of the stuff in the SSH config is already default.
• Why change the SSH port of a home server, which most likely is not reachable from the outside anyway?
• Actually potentially impactful stuff like disabling services you don't need, such as cups, is not mentioned
• unattended-upgrades not mentioned
• SELinux / AppArmor not mentioned
• LKRG not mentioned https://lkrg.org/
• Fail2ban not mentioned

Don't just copy random config from the internet, as annoying as it is, read the docs.

This is a nice list, but for the novices it's obviously meant for, it's a bad learning experience.

Why? Because it doesn't explain any of the reasoning behind what it asks you to do.

Why are we changing the default SSH port, for example? Someone who is seasoned might identify this is a somewhat limited attempt to obscure our attack surface, but to a novice it's inscrutable and meaningless.

More important than telling people what to do is explaining why, because it puts the learning in context and makes it stick by giving a reason to care.

Shamelessly plugging https://linuxupskillchallenge.org/ because if you're going to set up an Ubuntu home server you might a well know how to use it.

Running SSH on a non-provileged port brings new issues. And using 2222 doesn't bring any meaningful security by obscurity advantages.

The rest of the options look nice. It would have if there would be explanations on what the options do in the example configs