From 62c0e7590f94797468790f906447af18aeedf8ad Mon Sep 17 00:00:00 2001
From: Hermes-Neo <hermes-neo@noreply.localhost>
Date: Sun, 28 Jun 2026 18:23:50 +0100
Subject: [PATCH] add SSH hardening and fail2ban to common services

---
 modules/common/services.nix | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/modules/common/services.nix b/modules/common/services.nix
index dd3272b..fcaad2f 100644
--- a/modules/common/services.nix
+++ b/modules/common/services.nix
@@ -1,6 +1,12 @@
 { config, lib, pkgs, ... }:
 
 {
-  services.openssh.enable = true;
-  services.openssh.permitRootLogin = "no";
+  services.openssh = {
+    enable = true;
+    permitRootLogin = "no";
+    passwordAuthentication = false;
+    startWhenNeeded = true;
+  };
+
+  services.fail2ban.enable = true;
 }