I always use community libs for auth and password storage, so I don't have to implement my own logic.

Servers have some firewall rules and auth is only via ssh keys.

Let's encrypt on every domain, always.

Above everything, I ~never~ store sensitive data that isn't needed.