{ config, ... }:
{
  services.openssh = {
    enable = true;
    passwordAuthentication = false;
    permitRootLogin = "no";
  };
  networking.firewall.allowedTCPPorts = [ 80 443 22 ]; # ssh and website
  security.sudo.wheelNeedsPassword = false; # needed for deploy-rs

  security.acme.defaults.email = "anish+acme@lakhwara.com";
  security.acme.acceptTerms = true;

  services.fail2ban = {
    enable = true;
    maxretry = 5;
    ignoreIP = [
      "127.0.0.0/8"
      "10.0.0.0/8"
    ];
  };
}