how much you make it secure, that's how much it will be secured. it means, you will have to pay administrator to do it. it can be nginx or any other, just not apache.
you protect server with installing virtual machine and making hidden service inside VM, in that way attacker can attack VM but not host machine. so, host machine can be debian, for example.
beside it, you must choose hosting company, if you make mistake at that point, they can betray you or steal info about your users. and don't choose VPS, pay with btc and only at anonymous reg hosting companies, and so on and so on... you have my email.