Idk about giving a comprehensive answer, but getting full marks on the nextcloud security scanner is a good start: scan.nextcloud.com

I check mine periodically and make sure I’m on the latest version, use 2fa (passkey) and hope that does the trick.

Also there’s a plugin for brute force protection.

There’s a lot of discussion on a very recent post about doing this for Jellyfin. You should start by reading that: discuss.online/post/40181742