{ ... }:
{
  services.openssh.enable = true;
  services.openssh.settings = {
    PasswordAuthentication = false;
    PermitRootLogin = "yes";
  };

  networking.firewall.allowedTCPPorts = [ 22 ];
}