I just spent the last 6 hours implementing firewall rules to prevent troll farms from harvesting data via my Mastodon server's public API endpoints.
I also blocked proxy services and a clever server-side script that trolls are using to pretend they're actual servers instead of just one bot with an infinite number of accounts.
None of this is covered in the "how-to" run your own instance playbooks, though it should be.