Here's my advice:
Disable password authentication and allow only key/certificate/token/etc wherever feasible. Don't even ask for a password if some other authentication mechanism can be used instead. Human-memorized passwords are weak and generated passwords are a poor substitute for proper cryptographic key exchange.
su, sudo, and Polkit are privilege escalations waiting to happen. Remove them if possible; deprivilege them (remove the setuid bit) if not. Do not allow any means for an unprivileged user to get a root shell, regardless of authentication, because unprivileged accounts may be backdoored and letting them elevate will grant root privileges to the attacker as well.
On your local machine, always log in as root on a separate virtual console using a separate password. On remote machines, always log in as root using an ssh key only accessible to the root account on your local machine.
I'm iffy about hiding SSH behind a VPN. Doing this creates a serious risk of being locked out of your own server, and if your SSH server is configured correctly (as described above), then the security benefits aren't that big. If you do find the risks acceptable, feel free to do this, but you shouldn't feel obligated.
Docker is unnecessary complexity and overhead. Use systemd to isolate things; it can do things like filtering system calls and hiding portions of the file system. SELinux might be good too, if you can figure out how to use it (I never could).
Fail2ban is unnecessary if nothing accepts passwords for authentication. There are no fails to ban.