nixfiles/modules/ssh.nix

# Key-only sshd hardening, imported by hosts that run sshd (T400, Mac Pro,
# RPi5). Authorized keys are owned per-user by the registry (modules/users.nix),
# not here.
{ ... }:
{
  services.openssh.settings = {
    PasswordAuthentication = false; # keys only
    KbdInteractiveAuthentication = false; # no keyboard-interactive fallback
    PermitRootLogin = "no";
  };
}