{ config, ... }: { services.openssh = { enable = true; startWhenNeeded = true; permitRootLogin = "no"; passwordAuthentication = false; }; }