I operate SSH, nginx, and uvicorn like this:

SSH

• pubkey auth only
• not on default port
• AllowUsers var in sshd.conf is set

nginx

• runs as its own user
• serves static files or forwards to uvicorn
• rate limits are set
• returns 444 on requests that aren’t in sitemap.xml (nonsense and probing)

uvicorn

• runs as its own user

and a firewall runs on top of everything in a hardened kernel. I’m self taught, so I could be missing something obvious and this setup has been reliable for me for a few years.