@@ -183,13 +183,14 @@ in rec {
183183 networking = {
184184 inherit hostName;
185185 firewall.allowedTCPPorts = if enableHttps then [ 80 443 ] else [ 80 ];
186−
187− # `amazon-image.nix` already sets these but if the user provides their own module then
188− # forgetting these can cause them to lose access to the server!
189− # https://github.com/NixOS/nixpkgs/blob/fab05f17d15e4e125def4fd4e708d205b41d8d74/nixos/modules/virtualisation/amazon-image.nix#L133-L136
190− services.openssh.enable = true;
191− services.openssh.permitRootLogin = "prohibit-password";
192186 };
187+
188+ # `amazon-image.nix` already sets these but if the user provides their own module then
189+ # forgetting these can cause them to lose access to the server!
190+ # https://github.com/NixOS/nixpkgs/blob/fab05f17d15e4e125def4fd4e708d205b41d8d74/nixos/modules/virtualisation/amazon-image.nix#L133-L136
191+ services.openssh.enable = true;
192+ services.openssh.permitRootLogin = "prohibit-password";
193+
193194 security.acme.certs = if enableHttps then {
194195 "${routeHost}".email = adminEmail;
195196 } else {};