What is your main goal?
If your goal is performance and you can spare some offline time, then your current setup is fine, and what Quintiliano commented about using your DBs in containers may stand. While using Apache as reverse proxy is easy to manage, for better performance you can check HAProxy (it's not hard but takes time to get used to it). To increase your performance, you may need 2 or more servers and a Load Balancer (Load Balancer makes no sense with a single server). If you have a good connection you can use network interface binding to double your connection speed.
You can improve your security adding a router before your proxy (professional -expensive- or economic but full featured, such as ubiquiti, mikrotik, etc). You need to know how to set it up and protect your private network. In terms of security, is better to run your databases in containers and loose some performance. You can also set your proxy in containers. I would recommend to check traefik which is an easy-to-use Proxy/Load Balancer. You are right, a single server is easier to maintain than two servers.
If what you want is no-down-time, you will need to change your design. You need at least 2 routers and setup VRRP. You need to setup network interface binding and have at least 2 servers (more is best). You setup in your routers to send odd IPs into one of the servers and even IPs to the other (that way you don't need to synchronize sessions), and will load balance your connections. You will need a way to synchronize files from one server to another (in case of file upload, etc). I recommend to use unison, however I use LXD instead of docker, so I'm not sure if that will work in your case. For the database, its better to have them in a cluster, check Galera with maxscale. You usually need at least 3 servers for that, but it is possible to run it with 2 servers if you use Galera Arbitrator
That is only one way to go, there are many paths and this is my personal solution.
UPDATE (about security)
Seriously, how bad it would be if that business data leaks? You said it would be 'Fatal', but it is so? The reason I'm asking you this is because if its that important, then you shouldn't be doing this by yourself, but either with a specialized team or a security consultant. No matter how much you stick to the book, there is always room for mistakes if you don't have enough experience (and if you are asking in this site, is because you don't have it, is that right?). Don't take me wrong, if that data leaks, who is going to be blamed for it? In my personal case, I don't manage top secrets, so as long as I try to follow and apply above-standard security measures, I think its enough. From what I see in you security list, you are covering pretty much what I usually do, and so far I haven't had any security breach so far (that I'm aware of :P).
I have few more suggestions that could improve your setup:
1) Data protection: Please take a look into Data at rest encryption with MariaDB. That is a pretty easy way to get your data encrypted. The main benefit of it is that if your database files get compromised, they are useless without a key. If you store the key in memory is better as it won't be stored in your snapshots or backups, the downside is that you will have to enter that key each time you start the database. This encryption method won't help you if someone has access to the running instance (which is the most common way to hack into a database).
2) Applications: My guess is that your weakest link is in the application layer. You have to be sure your code is well protected and that is not vulnerable to XSS, SQL injections or alike. If you can't be 100% of it, better to keep highly important data as away as possible from your applications. Be sure you add more protection layers (like extra authentication, encryption of values in database, etc)).
3) Encrypted directories: Encrypting directories is usually helpful for those cases in which the server is stolen or someone gains access with a non-root user.
4) Backups: Keep a look where you store your backups and snapshots. They are as important as your databases. If your servers are infected with a ransomware (yes it could happen in Linux too), your backups can help you to save the day. Its a good idea to keep those in a safe location (restricted, encrypted and if possible immutable).
5) Local network: Be sure your servers are isolated from your local network. Don't assume that your local network is safe, so don't grant special permissions for local clients. Treat your server as if it were isolated in a remote place and only accessible through Internet, that way you will only protect a single entry point.
6) SSH: If you are still using port 22 for ssh, change it. I would recommend to use client keys additional to password for ssh (and additional to knock port).
7) Passwords: Be sure you keep all your server passwords safe with a well-tested password manager application. It doesn't matter how much you add into this security formula, if your personal computer is hacked and those passwords are compromised. So protect your personal computer as well as the servers. (you are using strong passwords, right?)
8) Backdoor: It has happened to me several times that I'm locked out! So keep in mind that it can happen to you too. Be sure that if you open an additional way to access the servers, those are as strong as the main one. If you have physical access to the servers, you don't have to worry too much about it.
9) Antivirus: Don't trust too much
clamAV. It's not a bad software, but you just won't have the same protection as with a commercial solution. I use it for my mail servers and in some File servers (Samba), to block well-known Windows viruses, but I don't count on it when it comes to new threats. Its better not to assume that it will protect you. As you know there is a very small list of known Linux malware, so if you are having performance issues due to clamAV, it probably won't change your security too much without it (if you are already protecting your server in many other ways). If you want a commercial solution, Sophos and ESET are good options. If you really want to be on top of all threats for your servers, you can try AlienVault (but you will need an extra server just for that).
Key Questions: (What would happen if someone...)
* gains access to the DB through my applications?
* gains access the containers?
* gains access to the servers as user?
* gains access to the servers as root? <-- usually this is gameover
* stole the server?
* has access to the local network?
* gains access to my 'development' computer?
I'm aware that many of the points covered here, you are already doing them, but I didn't want to assume anything. I hope you find my insight useful and if you have any other recommendations that I didn't cover here, I want to hear it.