{ den, lib, ... }:
{
  lux.services._.openssh = den.lib.parametric.exactly {
    includes = [
      (
        { host }:
        {
          nixos.services.openssh.settings.nixos.services.openssh = {
            enable = true;
            settings = {
              PermitRootLogin = "no";
              PasswordAuthentication = false;
              AllowUsers = lib.attrNames host.users;
            };
          };
        }
      )
    ];
  };

}