Hi everyone, what's the best way to harden a solidus installation in terms of security?

Configuring rack-attack on critical endpoints, like login and stuff, is a good first step.

I'm a fan of using something like Cloudflare as a low-effort 2FA, to block /admin access to only certain email domains.

+1 for Cloudflare. The standard plan is pretty cheap and will already handle a lot of stuff for you

Always a good place to get ideas - https://owasp.org/www-project-top-ten/

In addition to what these fine gentlemen have already said, I'd would like to mention this article I just wrote: https://medium.com/@brucedandbattered/openbsd-vs-docker-and-linux-deploying-ruby-on-rails-in-production-320c90bcb934