Fix everything.

system/services/general/ssh/default.nix

@@ -0,0 +1,22 @@
+{ lib, ... }:
+{
+  imports = [ ./fail2ban ];
+
+  services.openssh = {
+    enable = true;
+    settings = {
+      PermitRootLogin = lib.mkForce "no";
+      PrintLastLog = "no";
+      PasswordAuthentication = false;
+      UsePAM = false;
+      X11Forwarding = false;
+    };
+  };
+
+  environment.persistence."/persist".files = [
+    "/etc/ssh/ssh_host_ed25519_key"
+    "/etc/ssh/ssh_host_ed25519_key.pub"
+    "/etc/ssh/ssh_host_rsa_key"
+    "/etc/ssh/ssh_host_rsa_key.pub"
+  ];
+}

system/services/general/ssh/fail2ban/default.nix

@@ -0,0 +1,10 @@
+{ ... }:
+{
+  services.fail2ban = {
+    enable = true;
+    maxretry = 5;
+    bantime = "10m";
+  };
+
+  environment.persistence."/persist".directories = [ "/var/lib/fail2ban" ];
+}