add SSH hardening and fail2ban to common services

2026-06-28 18:23:50 +01:00
parent 6294c719c3
commit 62c0e7590f
1 changed files with 8 additions and 2 deletions
--- a/modules/common/services.nix
+++ b/modules/common/services.nix
@@ -1,6 +1,12 @@
 { config, lib, pkgs, ... }:

 {
-  services.openssh.enable = true;
-  services.openssh.permitRootLogin = "no";
+  services.openssh = {
+    enable = true;
+    permitRootLogin = "no";
+    passwordAuthentication = false;
+    startWhenNeeded = true;
+  };
+
+  services.fail2ban.enable = true;
 }