{ config, ... }:
{
  services.openssh.enable = true;
  networking.firewall.allowedTCPPorts = [ 22 ];
  security.sudo.wheelNeedsPassword = false; # needed for deploy-rs
}