# Key-only SSH hardening, imported by the hosts that run sshd (T400, Mac Pro,
# RPi5). The host config still does `services.openssh.enable = true` and opens
# port 22 next to where it documents the listening service; this module only
# tightens the policy so a host opting into sshd cannot accidentally ship
# password/root login. Authorized keys are owned per-user by the identity
# registry (users/registry.nix, applied via modules/users.nix), not here.
{ ... }:
{
  services.openssh.settings = {
    PasswordAuthentication = false; # keys only
    KbdInteractiveAuthentication = false; # no keyboard-interactive fallback
    PermitRootLogin = "no";
  };
}