Port forwarding opens an attack surface- whatever service you’re exposing is the “attack surface” so make sure it’s secure.

disabling password login

This is absolutely a very strong/good hardening first-step.

pubkey authentication

Hell yeah. Very strong. Just keep that key safe (don’t post it on the Internet, put it somewhere insecure or public, etc. Also recommended to password protect the key for extra safety.

Additional steps you could take if you were worried: two-factor authentication, usually easy to setup and effective. Fail2ban or other IP blockers, takes more work and setup. Rate-limiting is a basic feature most ssh services have (e.g. more than 3 failed attempts = 5 minute lockout).

But honestly keys-only, IMHO, is the safest 👍

Someone else already pointed out that server chassis provide ground continuity bonding to the rack…

Then I tossed the ground strap from the rack to my UPS’ ground screw…

And my UPS uses a grounded plug into the wall. Functionally grounded.