@@ -183,6 +183,12 @@ in rec {
183183 networking = {
184184 inherit hostName;
185185 firewall.allowedTCPPorts = if enableHttps then [ 80 443 ] else [ 80 ];
186+
187+ # `amazon-image.nix` already sets these but if the user provides their own module then
188+ # forgetting these can cause them to lose access to the server!
189+ # https://github.com/NixOS/nixpkgs/blob/fab05f17d15e4e125def4fd4e708d205b41d8d74/nixos/modules/virtualisation/amazon-image.nix#L133-L136
190+ services.openssh.enable = true;
191+ services.openssh.permitRootLogin = "prohibit-password";
186192 };
187193 security.acme.certs = if enableHttps then {
188194 "${routeHost}".email = adminEmail;