If you don’t mind I’d share my scenario with you, but I’m far from a professional myself, so in the same time I’m also asking any thought about my own approach.

For my public facing services (e.g. Nextcloud) I’ve created a separate VLAN which is completely isolated from the rest of the system, I’ve deployed an nginx LXC with Crowdsec/fail2ban, and opened very specific “pinhole” style firewall rules towards the service layer VLAN in OPNsense. I’ve also separated this service / app VLAN layer from the database layer (which is another VLAN with strict firewall rules and SSL). For authentication I use what the service offers natively, except for some cases of keycloak / hardware key.

Based on my research, this should be a solid baseline, but honestly noone more knowledgeable than myself has confirmed it, so take it with a grain of salt.

The first sentence gives away, that this is not a technical, but a psychological question. I think most of us know this feeling of this kind of urge, I’d say plan ahead, backup then upgrade. Or -depending on your usecase- a clean install and rebuild satisfies the urge even better. :) (no offense, I did this myself multiple times)