I’m currently self-hosting several services and looking to harden my setup
If you are looking to harden your server, might I suggest installing Lynis. Lynis will extensively scan your server, and at the end of the scan it will print the output of the test including a score of 1-100 and recommendations on how to fix, secure and harden the server. Not all of the recommendations will be applicable to you.
A proper WAF (Web Application Firewall)
I use Crowdsec. While Crowdsec is not a trad WAf, it is more than capable when set up correctly. I use Crowdsec in conjunction with UFW, Fail2ban, Tailscale, rkhunter, and chkrootkit. I have fail2ban in aggressive mode, since I am the only user, or legit user that is. ;) I have been accused of going overboard on security.
Traefik, BunkerWeb, and Pangolin.
You mentioned these, and I have never used them. I'm assuming you are going for a reverse proxy as part of your hardening methods. I use Caddy, and it's real simple to set up. It also takes care of your cert renewals automatically.
Bonus: nice dashboard or at least logs that make sense
Most of the logging apps like Syslog, Graylog, or similar I've found to be quite heavy as they need a lot of additional modules to run like databases, elastic, et al. I recently discovered lnav, with the help of the kind folks here. It is not a pretty, graphical, dialed out dashboard. You view the logs in the terminal. Very light on resources, and does exactly what it says on the tin. Check it out.
Tailscale
Do it! It's easy to set up and works very well. You can pipe all manner of things through Tailscale like ssh, sftp, etc.
Also, don't forget about using ssh keys. I know there is a lot of discussion about changing the ssh port number and how effective it really is. For about 5 minutes of your time, you can have it all set up, and it will at the very least, cut down a lot of noisy bots. If you want to go even further, you can set up host allow/host deny: sudo host.allow and sudo hosts.deny. Make sure you edit host allow first. LOL
You may want to look into Debsums, AIDE, iptraf-ng, Apparmor Deborphan, unattended updates, Maldet, etc, which will probably recommended by Lynis when you initiate a scan.