Port knocking, Wireguard, never look back. You can set an alert for every failed SSH connection because if someone is able to get through that, it's alarming. This setup has the side effect of reducing your log noise to zero. That SNR is super important for intrusion detection.
An upgrade to port knocking is Single Packet Authorization [1]. It doesn’t suffer from the observability, and other, problems of port knocking. [1] https://www.cipherdyne.org/fwknop/
Is there any other kind? SPA is the only port knocking I use!