Harden DigitalOcean Ubuntu Server Security

I run a custom web application on an Ubuntu droplet at DigitalOcean. Although every obvious door is locked—UFW rules are strict, all unnecessary ports are closed, Fail2ban is active, and SSH keys have been rotated—crypto-miners keep finding a way in and even wiping my authorized_keys file. and they also remove the logs.

I need a specialist who can dig deeper than the basics, trace exactly how the breaches occur, close those vectors for good, and leave the box fully hardened. Think kernel-level auditing, service isolation, intrusion-detection tooling, automated patching, and any other best practices you know work on Ubuntu in a cloud-VM context.

Deliverables I must see before sign-off:
• A concise report pinpointing the original compromise path(s) and the corrective actions taken
• Hardened server configuration (firewall, SSH, kernel, web stack) committed to an Ansible playbook or equivalent so I can reproduce it
• Live monitoring or alerting in place (fail2ban tuning, OSSEC/Snort/Wazuh—your call)
• Documentation of every change plus rollback instructions

If you have recent success stories securing Ubuntu servers from mining malware, let’s talk—my priority is a clean, resilient environment I can safely deploy to again.