From 1d5c1a7c2a73df548e1f709554d9b4dcfb31398e Mon Sep 17 00:00:00 2001
From: Hektor Misplon <hektor.misplon@pm.me>
Date: Sun, 1 Feb 2026 22:57:04 +0100
Subject: [PATCH] fix(ssh): harden ARM SD installer image SSH

---
 images/sd-image-aarch64.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/images/sd-image-aarch64.nix b/images/sd-image-aarch64.nix
index 0554c91..47e1563 100644
--- a/images/sd-image-aarch64.nix
+++ b/images/sd-image-aarch64.nix
@@ -37,7 +37,10 @@ in
 
   security.sudo.wheelNeedsPassword = false;
 
-  services.openssh.enable = true;
+  services.openssh = {
+    enable = true;
+    harden = true;
+  };
 
   # sdImage.postBuildCommands =
   #   let