profiles/core/default.nix

@@ -117,7 +117,8 @@ in
     # For rage encryption, all hosts need a ssh key pair
     services.openssh = {
       enable = true;
-      openFirewall = lib.mkDefault false;
+      openFirewall = lib.mkDefault true;
+      passwordAuthentication = false;
     };
 
     # Service that makes Out of Memory Killer more effective

profiles/iot/default.nix

@@ -0,0 +1,8 @@
+{ self, config, lib, pkgs, ... }:
+let inherit (lib) fileContents;
+in
+{
+  pub-solar.graphical.enable = false;
+  pub-solar.x-os.localProxyService.enable = false;
+  pub-solar.sway.enable = false;
+}