# sshd for the hosts that run it (T400, Mac Pro, RPi5): enable the daemon, open
# port 22, and apply a key-only policy. Authorized keys are owned per-user by the
# registry (modules/users.nix), not here.
{ ... }:
{
  services.openssh.enable = true;
  networking.firewall.allowedTCPPorts = [ 22 ];

  services.openssh.settings = {
    PasswordAuthentication = false; # keys only
    KbdInteractiveAuthentication = false; # no keyboard-interactive fallback
    PermitRootLogin = "no";
  };
}