[Alfa1]

Block any service that is not publicly needed for all IP's except your own. (pop3, ftp can easily be used to flood your server with requests) Close any service that you do not need or is not essential. Analyse the logs after every attack and try to prevent the same event happening again. In your position it is wise to trade in functionality for security.
Block IP's that make too many requests. Auto-Kill certain processes at times when your server is under heavy weather.
I have been in the same situation for a long time. My server has much lower specs than yours. On any given day my server is running on 300%, so it has been easy to bring down until it was locked down. Measures like these are not optimal as they will cause errors on your site, but at least your site will be hard to bring down by flooding it with requests.

A large DDoS however is hard to stop. best thing you can have is a host that picks up the phone 24/7 and is on the case swiftly. Look into Anti-DDoS hosting or getting a hardware Anti-DDoS firewall.