I close SSH port 22 (and what I use instead)

fail2ban and key-only auth are not enough. fwknop Single Packet Authorization keeps port 22 closed at the firewall, opens it for your IP for a few seconds, then closes it again.