How should you actually order a TLS cipher suite list rather than copying one from a blog?

How should you actually order a TLS cipher suite list rather than copying one from a blog?

A cipher suite names the key exchange, authentication, bulk cipher, and MAC. The order you publish for TLS 1.2 is a policy; in TLS 1.3 the negotiated set is fixed and short. Hardening procedure.

— Separate the two protocols mentally. TLS 1.3 offers only five AEAD suites (AES-GCM and ChaCha20-Poly1305); you cannot reorder them meaningfully, only enable or disable the protocol.
— For TLS 1.2, require ECDHE for forward secrecy and AEAD ciphers; drop CBC-mode and anything with RSA key exchange.
— Place ChaCha20-Poly1305 ahead of AES-GCM only if you serve many clients without AES hardware acceleration; otherwise AES-GCM is faster on modern x86.
— Set ssl_prefer_server_ciphers off for TLS 1.3 (clients choose well) but consider on for TLS 1.2 to enforce your order.
— Validate against the actual negotiated suite with nmap --script ssl-enum-ciphers or testssl.sh, not against your config file's intent.

Evidence vs. speculation: a config can list a suite the library has compiled out; only an active scan proves what is offered.

Further reading: RFC 8446 appendix B.4; Mozilla SSL Configuration Generator (Intermediate profile).

Bottom line: configure TLS 1.2 ordering deliberately and let TLS 1.3 pick for itself.