ITT a horde of people who don’t know that http is stateless. Cookies are the easiest and least intrusive way to maintain your session.

Proxmox is a decent option, or just use kvm provisioning directly with ansible.

• use pfsense for a firewall. Using nftables, firewalld, etc should only really come into play if on an untrusted network. Firewalls on servers can cause more problems than they solve and are easy to misconfigure.
• run lynis on your Linux servers to help get them compliant with CIS benchmarks
• be careful with your reverse proxies
• keep things patched
• run only necessary services
• configure needed services conservatively
• no root logins

IT isn’t developers. What is really needed is a developer on your team, or somebody who at least knows how to lead the effort. I’ve been that guy.