A firewall is never enough, it is the bare minimum. Then having an IDS of some sort is desirable. For example if your SSH port is exposed you should block brute-force attacks, even if you have a strong password. A typical server on the Internet is probed, attacked hundreds, thousands of times a day. I know, from all the alerts I receive in a single day and just by reading the logs. By the way, security can easily become a full-time occupation. And if you have logs but never read them, you could miss something.
If you are going to build a website from scratch I think the biggest danger comes from your own code. Your biggest enemy is you, if you don't know what you are doing.
For example if your code allows SQL injections, then ufw will not protect you. Using a framework should help you avoid some rookie mistakes but does not guarantee quality of code. You need to learn best practices and how to write secure code. The framework will not teach you that.
Since you've mentioned Python I suggest pylint to test the quality of your code. There are other tools, like Bandit or Mypy for more specific checks.
A WAF (web application firewall) could be beneficial too but will require some tuning to be effective without being too restrictive.
There are lots of things you can do to reduce your attack surface. Google: "Linux hardening". If I had to recommend a book it would be Hacking exposed for a comprehensive overview.
One important thing is to keep your system up-to-date. Vulnerabilities are found all the time, and sometimes 0days too so you have to react quickly to download an upgrade or a patch (one recent example that comes to mind is Exim). So I strongly advise to subscribe to a few mail lists, websites or blogs about computer security to keep on top of news.
Equifax was hacked due to a flaw that had been patched a few months earlier. Their procrastination cost them dearly. Not maintaining your system increases the risk considerably. All it takes is one exploitable flaw.
Finally, I would advise you to pentest yourself. To test for SQL injections SQLmap is a great tool. But to achieve best results you need to understand how the tools work, just running them with default options will most of the time not suffice to find flaws (unless the site is very poorly coded). Sometimes, webmasters leave sensitive files on their server like SQL backups, because they forgot to delete the file after restoring a database. A directory listing could reveal the presence of files that should not be there.
Many websites have a phpmyadmin directory, and no protection whatsoever against brute-force attacks. So a hacker could gain access to your database this way. If you really want to have phpmyadmin on the server, at least don't use a predictable directory name, and restrict access so that it's not exposed to the whole word for zero benefit.