{lib, ...}: {
  # borrowed from sioodmy's configuration
  services.openssh = {
    enable = true;
    settings = {
      PermitRootLogin = "prohibit-password";
      X11Forwarding = false;
      PasswordAuthentication = lib.mkForce false;
      KbdInteractiveAuthentication = false;
    };
    openFirewall = true;
    ports = [42069];
    banner = ''
          ⠀⢀⠀⢀⠀⡀⠀⢀⠀⠀⠠⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⢀⣀⡤⠖⠉⠁⠉⠈⠈⠉⠛⠓⠦⣄⡀⠀⠀⠀⠀⠀⠀⠀⠀⡀⠀⠀⢀⠀⠀⡄⠀
      ⠀⠂⢈⠀⠐⠀⠁⠂⡀⠁⠄⠂⠀⠁⣀⣤⠴⠖⠲⠲⢤⡀⠀⠀⠀⠀⠐⠀⠀⠂⠐⠀⠂⠀⠂⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠄⢤⡖⠏⢯⡓⠖⠲⠄⠀⠙⢦⡀⠀⠀⡄⠐⠀⠁⡀⠁⠈⠀⠠⠁⠎⠀
      ⢀⡐⠀⡀⠌⢀⠂⠐⠀⠁⠀⣠⡴⠛⠁⣀⠀⡀⠤⢀⠀⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣀⠀⡙⠞⣥⢮⡻⣶⡹⣭⢥⡉⢰⠆⠀⢳⡀⠀⠀⠀⠠⠐⠀⡀⢂⠐⡀⢀⣃⠀
      ⠀⠌⢀⠡⠈⠄⢈⠐⠀⢀⡾⠁⣀⡶⠩⣉⠉⠮⣄⣀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⡀⠀⠀⠀⢀⡀⣀⡤⣴⣲⠾⣥⠛⣀⠜⠀⠀⠈⢻⡜⣳⡍⣗⡚⠵⣀⠉⠓⡄⢫⡀⠀⢀⠀⠀⠂⠐⠀⠂⠐⠀⠆⠀
      ⠀⠈⠀⠀⠄⠀⠀⠀⢠⡟⠀⣠⠧⠖⣡⡜⡃⣴⠞⠀⠀⣠⠤⠴⢒⡤⠤⢄⣀⠠⣀⣠⢔⣊⡵⠧⣒⡭⢓⣱⣜⡳⣞⣋⡷⡭⣼⣓⠤⠄⠹⣳⡝⣧⢻⢰⣛⡤⠀⠨⣄⠳⡀⠀⠀⠀⠁⠀⠂⠀⡈⠀⢁⠀
      ⠀⠐⠈⠀⡀⠀⠀⢀⡿⠀⢀⡅⡾⣭⠞⡍⣰⠏⠀⢠⣟⠱⢋⡍⠛⣒⡤⠖⣊⡴⢋⡳⡏⠙⢒⡾⣱⢧⣄⡧⠚⡷⢤⣛⢡⣆⣱⠦⡹⣍⡀⠱⣻⣭⢧⣻⠀⢻⢦⠀⠀⠄⠻⡀⠀⠀⡀⠀⠀⠁⡀⠄⠂⠀
      ⠀⠀⠠⠀⠀⠀⠀⣾⠁⠀⡞⣼⢳⣝⢶⡝⣳⠄⡶⠏⠐⡤⢑⣜⣋⠡⠴⢛⣡⡴⣋⣡⢷⡞⢫⡗⢻⠸⢨⡶⢝⡳⢳⡚⢳⠚⡦⢧⠜⠲⠷⣀⠲⣹⢾⣱⡛⡖⠣⣬⡉⠀⡀⠻⡄⠀⠀⠀⠀⡀⠀⢀⠀⠀
      ⠀⠀⠀⠀⠀⠀⢼⠃⠀⢠⣟⡇⣇⠿⣞⣸⠇⢩⠞⢡⠘⡔⠫⠔⠢⢃⣰⢶⡹⠀⡏⢳⢋⡴⢫⡰⢹⡌⣧⢶⣫⢗⣯⣝⡳⡝⣡⢚⡌⢢⠡⡙⠧⡜⢧⣯⣝⣳⡀⠤⢙⡆⠀⡄⢳⡀⠀⠀⠀⠀⠀⠀⠀⠀
      ⠀⠀⠀⠀⠀⢀⡟⠀⢐⡿⢮⣝⡞⣟⢮⢗⡈⢴⠉⡄⢪⢌⡣⣭⣳⢏⡷⣮⡵⣳⡴⢛⣎⠷⣫⠅⣿⢼⣫⢷⣋⡟⠶⣫⡙⢿⡤⣏⢄⢫⡑⢌⠢⣉⠷⣞⢮⣱⢷⠐⡠⠙⡳⣄⠀⠳⡄⠀⠀⠀⠀⠀⠀⠀
      ⠀⠀⠀⠀⠀⢺⠐⡇⣸⢏⡿⣸⡝⣽⡞⠏⢠⡏⠰⡈⢶⣩⢷⢻⡜⠫⣷⢣⣟⣵⡻⣌⡌⣧⢁⠺⡽⣞⡽⢮⣳⠷⣤⢳⣻⠀⣻⢼⡂⡥⢙⠦⣇⡒⢚⢹⡞⣧⢯⡗⢠⠓⣀⠈⢳⡄⠱⡄⠀⠀⠁⠀⠀⠀
      ⠀⠀⢀⠀⠀⠃⣠⠃⣾⢹⢎⣳⡝⣮⡝⢧⠞⠼⢁⡘⣶⣹⠁⣟⠶⣴⢏⣟⡾⡼⣝⡧⡛⠄⣎⠡⣟⠽⣾⡩⢷⢻⡝⣮⢃⡴⡻⠼⢱⡘⢥⣊⡴⢭⣉⢲⠹⣗⡮⡟⣦⠉⠳⣆⠋⢲⡄⠘⣆⠀⠀⠀⠀⠀
      ⠀⠀⠀⠀⠠⠀⢩⠄⢹⣏⠾⣤⣟⡳⢣⠔⣊⠱⢊⠵⣌⢷⣦⡈⢿⣜⣫⡞⣵⡻⢹⠢⡑⠬⡰⢑⡚⡛⢶⢻⢍⠻⡚⡍⢏⠴⡱⢊⠥⣸⠦⢏⠖⡒⠆⢎⡱⣹⢞⣽⣣⢞⢡⢸⢓⠦⠸⣇⠈⢣⡀⠀⠀⠀
      ⠀⠀⠀⠀⡁⠠⠁⣠⢿⢈⣶⡻⣼⠽⣀⠞⡠⣙⢢⠓⡌⢆⠳⡹⢏⣞⡱⢋⠣⢰⠁⢆⠁⠆⡑⢢⠌⡱⠬⢆⡩⢒⠱⣘⠊⡴⢡⠎⣒⡱⢊⠜⡢⣑⢚⣉⠳⣍⡿⣖⢯⢾⡱⢢⡜⠘⢢⠉⡷⡀⠀⠄⠀⠀
      ⠀⠀⠀⠀⠀⡘⠠⢁⢋⢾⡵⣻⢵⣃⢐⣊⡵⢋⡉⠻⡌⣉⠣⠌⢡⡀⣆⠱⠶⠥⣈⠀⠅⠂⠡⠈⢆⠀⠉⠉⠳⠓⠶⣀⠣⠄⡙⢋⢣⠷⣬⢛⡥⢟⣓⡦⠷⣉⡴⢯⣻⢞⡷⣎⡝⢆⠢⠏⠠⢑⠀⡀⠀⠀
      ⠀⠀⠈⠀⠰⠀⡑⢠⢚⣯⢶⣏⠷⢈⡽⢎⣥⢦⣰⢥⡴⢲⠞⡚⠩⠗⠉⠀⠀⢀⣀⣀⣤⢤⠴⡤⡼⢤⡤⣄⣀⠀⠀⠀⠀⠆⡀⠈⠉⠁⡈⠒⠊⠓⠒⠴⠐⠂⡐⢈⠇⣟⣺⡵⣛⡴⢀⠫⠔⣀⠢⡅⠀⠀
      ⠀⢀⠂⡠⢁⠢⠜⣰⣻⢎⡗⢊⡹⠦⠋⠍⠈⠓⠉⠒⠌⠉⠉⠐⠄⢀⣤⢖⡷⣋⠜⠡⠤⢂⠒⠴⠐⠢⠶⠌⣍⢛⡶⢦⣄⠀⡈⠀⠒⠀⢀⡉⢀⡀⠒⢀⡘⢢⠐⠂⢈⠙⢧⡻⢧⣛⢦⠑⡈⠔⡂⠌⡐⠀
      ⠀⠂⠀⢀⢢⢄⣯⠷⡹⢊⠓⠉⠀⠀⢀⠠⠠⠄⠠⠤⠒⢂⡁⣠⢶⣛⡼⢋⠐⢠⠈⡐⠂⠌⠐⠄⠓⠰⠀⢆⠠⠌⠈⣗⢺⣻⣔⡓⠤⡌⠠⢀⡀⠉⠶⠤⣀⠉⣙⠲⢤⡈⠲⡝⢯⣻⡜⣧⠁⡆⠘⡐⠤⠁
      ⠀⠠⠚⣩⢃⣾⠚⠡⠐⠠⢈⡈⠁⠰⠀⠀⠄⠒⢂⡲⠖⢺⡼⣏⡷⠋⢚⣈⡤⣀⡤⣒⠤⠃⠖⣠⢒⡴⣚⣸⢦⣒⡶⢤⡈⠳⣞⣭⣂⠈⠲⠤⣀⡡⠀⠲⣈⠓⢤⡙⢦⡙⢦⡘⢲⣟⡼⣕⢫⡐⠩⡔⢈⠂
      ⢀⠓⣨⢃⣾⠳⠀⠀⡀⣁⡀⢀⡄⠒⠄⠲⠄⡈⢡⡥⢖⡯⣞⡽⣘⡤⡾⣝⠞⡵⢊⡅⣊⠍⣦⢥⠿⠼⣱⠖⣊⡳⢽⣎⣗⠷⣎⡷⣍⣏⠲⣀⠄⠠⠉⣀⠈⡳⠄⢉⣆⠹⣄⠱⣀⠺⡽⣞⡤⢋⡱⢌⠢⣁
      ⠀⠰⡜⣻⣼⠃⢠⠭⢛⠅⠀⣀⣠⠴⠞⡥⠘⣙⡯⢁⢪⡗⣯⢳⣭⣳⢏⣝⡺⣔⢫⡜⣦⢻⡬⡟⣎⢷⣣⢟⡵⣹⠶⣜⡾⣻⡼⣹⠶⣈⠳⡉⠒⠓⢢⢀⠡⢀⠋⠓⠬⡶⢬⣉⠑⡈⢸⡳⢜⠣⡜⢢⠱⠠
      ⠈⡰⢍⡷⣞⠁⠈⡼⠋⠠⢾⣩⠖⣁⡶⢠⡟⣉⡴⣨⠗⣹⡽⣚⡶⢯⣞⡧⢿⣜⣧⢻⡜⡧⣝⢺⢭⡞⡵⣯⢞⡷⣻⣝⢾⡳⣽⣹⠳⣄⠻⢄⡏⡆⠨⠙⢶⡄⡚⠑⠣⠙⠦⣍⡛⠵⢀⡿⣎⠳⡘⠡⠃⠁
      ⠠⠑⡬⢳⣻⠀⠾⢁⣼⢢⠟⣀⠾⣹⠀⡾⣅⢎⠰⣳⢌⡼⢳⡻⣜⡿⡼⣽⣫⣞⡞⣧⢻⡜⣭⢞⣣⢟⡽⣞⢯⣞⠷⣭⡳⣟⡼⢳⡹⣂⢭⢂⣹⡘⢧⣉⢦⢳⡌⡉⢆⠳⣔⢈⢻⣧⡀⠛⠀⠃⠈⠀⠀⠀
      ⠠⢉⠴⡙⣮⣝⠀⠈⣶⣻⢠⠟⣼⣃⡼⢑⢾⠈⣼⢃⡼⢡⡟⡵⣻⢼⣳⠳⢧⣛⡾⣝⣧⢻⣬⢳⡝⣾⡹⡞⢯⡞⣯⣳⡽⣹⠞⣍⢒⣇⢻⣆⢦⢳⣈⢟⣎⣦⠙⣦⠌⠳⢫⡦⣍⢲⡇⠀⠀⠀⠀⠀⠀⠀
      ⠀⠁⠢⠧⣹⢺⡅⠀⣻⢥⣻⢞⡕⣞⣸⡌⠦⣽⠣⢬⢃⢺⢃⠧⡙⢮⣵⢻⣻⡼⣳⠼⣎⠷⣎⠷⣹⢖⡳⣽⡳⣽⣣⠷⣽⢣⡛⢤⢛⢦⡹⣎⢮⡇⢧⢊⣎⠞⢧⡘⣧⠧⢳⣜⡎⣷⡛⠀⠀⠀⠀⠀⠀⠀
      ⠀⠀⠀⠀⠀⠀⠀⠀⢫⢿⡼⡹⣞⣥⠖⣼⣹⠎⣡⠎⡤⠋⢌⡢⢍⢢⠘⣋⠖⡻⢭⡟⡾⣹⢮⣻⠵⣾⡹⣇⡟⠶⣉⠞⣸⢧⠙⠆⣍⠢⣇⠹⣆⢽⢫⡔⡚⡼⢎⣧⠘⣟⡦⣜⣻⡼⠃⠀⠀⠀⠀⠀⠀⠀
      ⠀⠀⠀⠀⠀⠀⠀⠀⠀⢻⡞⣽⠰⣏⣾⢳⡍⡰⡼⠐⠤⡹⠠⢑⢊⠆⡹⢀⠋⡅⠳⡘⣍⠳⣯⣜⡛⠦⡑⢎⡜⣡⠣⠜⣧⠚⣧⠘⣸⢱⢯⡐⢌⡟⢦⡸⢁⡹⠂⡽⣞⡰⣟⡎⣷⠹⠀⠀⠀⠀⠀⠀⠀⠀
      ⠀⠀⠀⠀⠂⠀⠀⠀⠀⠀⠹⡇⡿⣜⠣⣏⢻⡳⣥⣋⡴⣁⠂⡍⢀⢎⣁⠚⡸⢐⠣⢓⣬⠟⡰⢮⡱⠅⡏⢶⡹⠰⡌⣸⡍⢛⢬⣃⢾⡈⢾⡉⣦⢹⢳⣳⢦⠰⣁⠿⣎⢷⡺⡽⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀
      ⠀⠀⠀⠀⠄⠀⠀⠀⠀⠀⠀⠉⢳⣍⢿⣹⣎⢷⠩⣳⢏⣟⠾⣥⣜⣠⢆⡴⢥⣖⡰⣟⡎⣥⢧⣟⣳⡼⣻⢬⡷⡽⢶⡤⢷⣫⡴⣭⢦⣻⢎⡿⡵⣯⠟⣼⣃⣻⡭⣗⢻⢮⠝⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
      ⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠙⠊⢷⡺⢆⡳⣄⠛⡌⢻⡅⠞⣩⠛⡞⢿⢼⡳⣏⠾⣽⢳⡞⣧⢿⡱⣟⠾⣝⢯⣽⠫⣷⡙⠾⡩⢞⡍⠷⡙⡤⢋⡶⢜⣃⡟⣼⠋⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀
      ⠀⠀⠁⠀⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠈⠹⠯⡵⣫⡜⠳⢢⣇⠰⢂⢉⡰⢈⠂⠔⡉⡑⢨⠀⣟⢆⡈⢳⡎⢳⡈⢋⢦⡑⠤⢱⢃⠱⡈⢶⢁⠦⢙⡁⢲⡺⠎⠉⠁⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⢀⠀⠂⠀
      ⠀⠀⠄⠀⠂⠀⠀⠄⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠃⢹⢃⡉⢘⢫⢦⡠⡍⢢⠘⣢⠘⡅⣳⠸⡜⡘⣎⡄⠚⢮⡕⠈⣆⠸⣁⠾⠐⣢⠑⢃⠈⣐⣤⢖⣏⢷⣃⡤⠀⠀⠀⠄⠀⠀⠀⠀⠀⠀⠄⠀⠠⠀⠀
      ⠀⠠⠀⠀⠌⠀⠠⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⠀⣰⢮⣟⣲⢳⢦⡦⣕⣀⢆⠡⣤⠈⡰⢇⡆⠳⠰⠉⣌⠱⡈⢹⡄⢒⣴⣀⣢⡵⣦⢞⡳⣻⡙⣎⠿⡼⢳⡞⣽⣛⢦⡤⠀⠀⡀⠀⠀⠠⠀⠀⠈⢀⠀⠀
      ⠀⠀⢂⠠⠈⠄⠐⠀⠁⠀⠀⠀⠀⠀⠀⠈⠀⣠⠿⣝⠶⣉⢮⡙⢦⡹⢩⠞⣫⢟⡭⢷⢶⡶⣞⢶⡻⢶⡼⣳⢞⡟⣶⡻⢮⣝⣳⢞⣱⣫⣕⢣⡛⣬⢻⣜⡣⡜⡒⢏⢷⣙⢧⣀⠐⢆⠀⠀⠄⠁⠄⠠⠀⠀
      ⠀⠈⡀⢀⠐⠀⠠⠂⠀⢈⠠⠀⠀⠀⠀⣀⣾⢓⠫⢜⡢⢱⢊⠵⢢⠳⣉⢞⡡⢎⡵⢋⡖⣱⢚⣧⡙⢧⣙⣧⢋⡿⡴⣩⠳⣜⣏⠺⠴⣡⢎⡣⣝⠲⣍⠞⡵⣛⠽⣎⣦⡭⢷⣺⡄⠘⢦⡀⠀⠂⠄⠀⠐⠀
      ⠀⠐⢀⠀⠂⠐⠀⠄⡀⠄⠀⠀⠀⠀⣲⡝⢒⠣⣘⠢⣉⠦⡹⣌⠣⢓⡬⢊⡔⣣⢜⡡⢞⣡⢛⡦⢿⠱⣎⢷⡫⡽⣘⡧⢿⣤⢻⡜⢧⡱⡎⠽⣆⠿⣘⡙⠶⣉⠳⡘⠦⣉⠛⣦⡛⢧⡀⠳⡄⠀⠂⢈⠀⠀
      ⠀⢈⠀⡀⠡⠀⢈⠀⠀⠀⠀⠀⠀⣼⡓⡜⠃⢦⢁⠣⢆⡲⢡⢆⡙⢆⠣⣑⠎⡰⢌⠲⡍⣰⡋⠗⣌⢣⠚⣥⢳⠳⢄⠫⡞⣌⠣⢽⡸⣳⢉⡧⡙⣦⠙⢮⡑⢎⡿⣁⠳⢬⣑⠲⣍⢳⡳⠆⢹⠀⠀⠂⠀⠀
      ⠀⠀⠂⠐⠀⠂⠠⠀⠂⣀⠀⢀⡬⣱⡐⢌⣡⠃⢎⡱⢉⢴⢃⣢⠛⡄⢣⠁⢎⠰⢉⠒⡠⠁⡍⡒⠨⢌⡑⢄⠢⡙⢌⠱⡈⠔⢣⠌⣱⠘⣎⠸⡕⢨⢟⡆⡟⣆⢳⡌⢷⡂⢽⡒⡜⡶⣍⣣⡈⠀⠀⠁⠀⠀
    '';
  };

  services.fail2ban = {
    enable = true;
    maxretry = 3;
    ignoreIP = [
      "127.0.0.0/8"
      "10.0.0.0/8"
      "192.168.0.0/16"
    ];
  };
  programs.ssh = {
    startAgent = true;
    pubkeyAcceptedKeyTypes = ["ssh-ed25519"];
  };
}
