Don't run pgbackups on all servers; just postgres-servers
Schedule pgbackups base backup
Add more files to monitor for remote_syslog task
Disable password-based logins.
Don't setup a Template App Zabbix Server.
Install unattended-upgrades on all servers.
Add Zabbix template for Ubuntu servers with check for non-installed security updates.