{
  outputs,
  ...
}:

{
  imports = [
    outputs.nixosModules.openssh
  ];

  services.openssh.enable = true;

  # Root SSH key for deploy-rs (key-only, no password)
  users.users.root.openssh.authorizedKeys.keyFiles = [
    ../deploy-key.pub
  ];
}