During our annual security review I was reminded of an incident earlier this year where we received a threat to our organizations web server. It was over a organization policy and threatened to DDoS our site. Fortunately, nothing bad came of it and it turned out to be an empty threat. However, we still notified the CIO, CSO, and CEO and our hosting provider immediately who applauded our response. Due to the nature of our organization(in education) the preemptive response involved many people including coordination with local law enforcement.
Even though our response was plenty for an empty threat it is making me realize how little attack planning the web app has undergone. Right now the setup is:
- A Linode VPS that is not behind the enterprise firewall (there's a long story behind this that isn't worth explaining)
- a PostgreSQL DB on the same server that only allows local connections
- a Nginx server that we are currently following best practices to secure 
- SSH access that we are migrating to certificate authentication
- A backup VPS that has all the latest server settings and just needs the latest version of code pushed and database settings migrated (Right now used as a test server but also envisioned as a georedundancy option)
I guess my question can probably be boiled down to what other steps should I take to lock down my server as well as protect from DDoS? We would love to use Cloudflare Business with their DDoS protection, but we don't always need it and $200 a month is a bit steep for the organization. Do I even need this? Is there a solution that allows temporary DDoS protection? If not, what is the best way to maintain stability during/after an attack? Finally, what logging should be implemented so that we can assist law enforcement in the event an attack occurs?