infra/config/network.nix

{
  networking.firewall.enable = true;
  services = {
    fail2ban.enable = true;
    openssh = {
      enable = true;
      ports = [1322];
      settings.PasswordAuthentication = false;
      settings.PermitRootLogin = "no";
    };
  };
}