{ den, lib, ... }:
{
  lux.services._.openssh = den.lib.take.exactly ({ host }: {
    nixos.services.openssh = {
      enable = true;
      settings = {
        PermitRootLogin = "no";
        PasswordAuthentication = false;
        AllowUsers = lib.attrNames host.users;
      };
    };
  });
}