Bad eh security advice: use an alternative ssh port. Lots of actors try port 22 and other common alternatives. Much fewer will do a full port scan looking for an ssh server then try brute forcing.
I have both but just use pihole as a local DNS server/forwarder. I bump into too many random times where sites or redirects don't work properly since they get blocked.
Consider using containers. I used to think this way, though now my goal is to get down to almost all containers since it's nice to be able to spin up and down just what the one 'thing' needs.
People are generally nice. Though honestly my wife is a 10 and I'm like a -3. It's all in the eyes of the beholder.