{ config, ... }: { services.openssh = { enable = true; passwordAuthentication = false; permitRootLogin = "no"; }; networking.firewall.allowedTCPPorts = [ 80 443 22 ]; # ssh and website security.sudo.wheelNeedsPassword = false; # needed for deploy-rs security.acme.defaults.email = "anish+acme@lakhwara.com"; security.acme.acceptTerms = true; }