From 58642c9e15b33e7ec03e2511534a7ac427ef452b Mon Sep 17 00:00:00 2001
From: Hektor Misplon <hektor.misplon@pm.me>
Date: Sun, 1 Feb 2026 22:57:04 +0100
Subject: [PATCH] fix(ssh): harden ARM SD installer image SSH

---
 images/sd-image-aarch64.nix | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/images/sd-image-aarch64.nix b/images/sd-image-aarch64.nix
index 0554c91..47e1563 100644
--- a/images/sd-image-aarch64.nix
+++ b/images/sd-image-aarch64.nix
@@ -37,7 +37,10 @@ in
 
   security.sudo.wheelNeedsPassword = false;
 
-  services.openssh.enable = true;
+  services.openssh = {
+    enable = true;
+    harden = true;
+  };
 
   # sdImage.postBuildCommands =
   #   let