HermitCollective.nix/system/ssh.nix

{  # Enable and configure openssh
   services.openssh = {
     enable = true;
     settings = {
       PasswordAuthentication = false;
       PermitRootLogin = "no";
       X11Forwarding = false;
     };
   };
}