I don't do much other than setting up ufw to block all ssh connections and the "standard" firejail configuration. There is also nextdns set up via my sbc (Orange pi zero 3) which is pretty nice for a "quasi-network-wide ublock".