Web Server security settings

Are there any specific security/restrictions I should place on my webserver to secure access for suitecrm. I’m more accustomed to laravel based apps where all of the code is outside of the public directory.

I’m using Caddy v2. Here’s the only relevant thing I have in my Caddyfile

rewrite {
to {path} {path}/ /index.php?{query}

If you’ve used Caddy or nginx or even apache, what settings have you put in place?