nixos/config/common/services/ssh.nix

{ ... }:
{
	services.openssh = {
		enable = true;
		permitRootLogin = "no";
		passwordAuthentication = false;
		challengeResponseAuthentication = false;
		kexAlgorithms = [ "curve25519-sha256" "curve25519-sha256@libssh.org" ];
	ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes128-gcm@openssh.com" "aes256-ctr" "aes192-ctr" "aes128-ctr" ];
		macs = [ "hmac-sha2-512-etm@openssh.com" "hmac-sha2-256-etm@openssh.com" "umac-128-etm@openssh.com" ];
	extraConfig = "
		HostKeyAlgorithms ssh-ed25519,rsa-sha2-512,rsa-sha2-256
		";
	};

	programs.ssh.knownHosts = {
		despondos = {
			hostNames = [ "despondos.nao.sh" ];
			publicKeyFile = ../data/pubkeys/despondos_host_ed25519_key.pub;
		};
	};

	#services.sshguard = {
	#	enable = true;
	#	blocktime = 300;
	#};
}