{ pkgs, lib, ... }:
{
  services.openssh = {
    enable = true;
    settings.PasswordAuthentication = false;
    # settings.UsePAM = false;
    openFirewall = lib.mkDefault false;
    allowSFTP = lib.mkDefault false;
    # startWhenNeeded = true;
  };

  users.users.root = {
    # isSystemUser = true;
    # isNormalUser = true;
    uid = 0;
    openssh.authorizedKeys.keyFiles = [ ../ssh/id_ed25519_sk.pub ];
    # home = "/root";
    hashedPassword = null;
    createHome = lib.mkForce true;
  };

  programs.ssh.startAgent = true;
  # security.sudo.enable = false;
  # services.yubikey-agent.enable = true;
}