@abcdw Why not put it behind something like Wireguard?
Personally, I use a VPN (an actual one, not a tunnel) to connect my machines. SSH doesn't even go on the public internet anymore.