Do you really need SSH exposed? If not, use something like WireGuard (or Tailscale) and bind only to that interface. You can also change the default port, you

Do you really need SSH exposed? If not, use something like WireGuard (or Tailscale) and bind only to that interface. You can also change the default port, your logs will quiet down dramatically. Lastly, if you have a long enough passphrase with enough entropy/randomness, password authentication being enabled is probably fine, you can also set only a specific user allowed to SSH for additional hardening.