{ config, ... }: { services.openssh = { enable = true; settings.PasswordAuthentication = false; settings.PermitRootLogin = "no"; }; networking.firewall.allowedTCPPorts = [ 80 443 22 ]; # ssh and website security.sudo.wheelNeedsPassword = false; # needed for deploy-rs security.acme.defaults.email = "anish+acme@lakhwara.com"; security.acme.acceptTerms = true; services.fail2ban = { enable = true; maxretry = 5; ignoreIP = [ "127.0.0.0/8" "10.0.0.0/8" ]; }; }