You appear to be already using Cloudflare so it might be doing a “good” enough job to combat spambots and other adversaries.

Since I don’t much like cloudflare, my instance uses Crowdsec which uses a crowd sourced block list aggregated from other servers to block out nasty IPs that have a bad reputation for attempting to run automated exploits, spam, overzealous crawlers, and other assorted nasty stuff on said servers that the list is crowdsourced from. A lot of Tor exit nodes, to no surprise, are on that list too.

Idk this is something that might pique your interest if you want to further harden your setup.

In your nginx.conf it’s access_log = off; under rhe server block. In docker-compose.yml you set all the stuff in RUST_LOG from info to error. For pictrs you add the PICTRS__TRACING__LOGGING__TARGETS=error env var.

I’m a unique case because my first foray into Linux was using the CLI via SSH on a server, and I thought the CLI was insanely cool and was immediately hooked. So I don’t really have any good advice other than to just force yourself to use it I guess?

Ironically, I have a more difficult time using desktop Linux just because it’s not a headless environment like I’m used to. I still use it ofc.