[plasma]

Run Tailscale on your server, bind the ssh port to the Tailscale local address only, then you can just logon to Tailscale to access SSH, no longer publicly accessible.

[jackhalford]

Or just use tailscale ssh, and turn off the old sshd.