What are some of the core bases I should cover for securing a django application?

I'm hosting the server on a vanilla ubuntu box from DO, so I've read into disabling root ssh access and removing ssh password authentication. I'm using nginx as a proxy, but I'm not sure if there is work I need to do there as well.. I'm currently wo...