Practically: Ports 22, 80, and 443 open and directly accessible from 0.0.0.0/0 is extremely manageable.