https://www.linuxatemyram.com/
This is normal. Linux caches disk reads so that you don’t have to go to her/SSD to reread blocks. If your app isn’t using the ram Linux will use it instead.
Zero reason to be concerned, because if your app allocates more memory Linux will evict the cached pages to make sure your apps have plenty of space.
In this case your apps have memory that isn’t being touched (sometimes a sign of a memory leak), and Linux has decided that caching your disk access is more advantageous than keeping the unused application memory in ram.
If you have apps that you don’t use often and are really slow to access when you finally do, keep lowering that swappiness value or just remove swap all together if it annoys you.
Looking at your graph you have a lot of ram that you don’t really need… I would just disable swap entirely. Otherwise you are just wasting write cycles on your SSD.
It certainly isn’t good to depend on it but security by obscurity is your first and probably most important line of defense. When these vulnerabilities come out they need to know your service exists to exploit it.
The best way to do that is to setup a reverse proxy to reject invalid hostnames. A single port is all you need exposed for multiple web services, and the IP scans won’t find the script kiddies anything valuable. Be careful with lets encrypt, there is a public journal of all issued certs, so make sure to get yourself a wildcard cert so that you aren’t advertising your valid hostnames to the world.
Use the reverse proxy to put basic auth in front of your services (if they can handle that). Basic auth is very simple, no web forms to attack, just a single header. If your php site is vulnerable they won’t ever be able to even attempt to reach it without a valid username/password.
I’ve got a mix of containers and VMs behind that reverse proxy. The containers have network security groups around them limiting network access. The VMs are in a Harvester hypervisor with KubeOVN for software defined networking. That means each VM is in its own subnet with network security groups around the subnet preventing any unnecessary network access.
For machines/containers that need Internet access I have a Squid proxy with an explicit whitelist of allowed URLs so that the machines can’t reach out to unauthorized sites to download their malware or contact command and control nodes.
Unattended updates for the VMs, and FluxCD keeping helm charts up to date hourly for the containers. For my own containers, weekly scheduled container rebuilds.
I do have one public website that I host for a friend (indexed by search engines so the sites name is known to the world). My friend had originally deployed that as a WordPress site, but WordPress/PHP don’t have the best security track record so I was concerned about that. The site was pretty simple so I recreated it as 100% static content, so now the attack surface is just a nginx container with a read-only filesystem.