As the title asks, how do you know when it is secure enough? I've done all the basics, the next step would be to chroot the services like apache & mysql but i wonder if i honestly need to do it. Why stop there, I can strengthen chroot with grsecurity. When is it enough?

#1 Security doesn't exist if you are plugged into a network.
There is never 'enough' security. At some point you just have to stop implementing tactics.

That said, I'll try to give a checklist of security related things:

Are all packages patched.
Is your kernel up to date. (can you remove unneeded features)
What do port scanners reveil.
What does a nessus scan reveil.
Is your IPTables allowing only the required traffic IN and OUT.
As you've stated, Can chroot be implemented.
Can a security policy be implemented. (grsec, selinux)
Are daemons running as non-priveledged accounts.
Are you monitoring your logs. What do they reveil.
Can you disable certain daemons from running. (only enable what is required)

Install tripwire and see if they get in

Keeping an eye on your system (logfiles, using tripwire, etc) after securing it is most important. Further tighting it down can be a great learning opportunity (that's why I do it) but unless you're on the edge of a major corporate network I think the added value is minimal.