linuxlab.nix/shared/system.nix

{
  services.haveged.enable = true;

  services.openssh = {
    enable = true;
    settings.PermitRootLogin = "without-password";
  };

  networking.firewall = {
    allowedTCPPorts = [
      22 # SSH
    ];
  };
}