A new VPS is reachable from the whole internet the moment it boots, and automated scanners find it within minutes. None of what follows is advanced; the order is what matters, because doing them in the wrong order leaves a window.

1. Update, before anything else

apt update && apt upgrade -y

2. A user that is not root

Working as root means every mistake is unrecoverable and every compromise is total. Make a user, give it sudo, and keep root for the few things that need it.

adduser ops\nusermod -aG sudo ops

3. Your key on that user, tested in a second window

Test the key in a NEW terminal before you close this one. If the key does not work and you have already disabled passwords, you are locked out of your own server.
ssh-copy-id ops@your-server-ip\n# then, in a NEW window:\nssh ops@your-server-ip

4. Turn off password logins

Only once the key works. This single change ends brute-force attempts against your server, because there is nothing left to brute force.

# /etc/ssh/sshd_config
PasswordAuthentication no
PermitRootLogin no
# then
systemctl reload ssh

5. A firewall that starts closed

Allow what you need and nothing else. Allow SSH first, or you will lock yourself out with the next command.

ufw allow OpenSSH\nufw allow 80,443/tcp\nufw enable

6. The clock

A server whose clock is wrong cannot validate a TLS certificate, and the errors it produces look like anything but a clock problem.

timedatectl set-ntp true\ntimedatectl
Write down what you did in a file on the server itself. In six months, the question "why is this configured this way" is asked by you, about your own work.