{
  config,
  pkgs,
  ...
}: {
  users.users."grey".openssh.authorizedKeys.keys = [ "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQCeYFzFyv1LEdWngyTDqnsdJQhmgAfQbbksyZrNWkameVMJpi8IJ+3IIrL96BtD8EAC/jxHIbri49TInN0lYRBH3cH3jbBupdDFaziH3ohyMoeg8enKYsiisaT+MTGEGFygF9Ul1WDrOM1oThEP1LTYj5pWNfZRtIG870jLzRkNczb0eCtEO0qWtyH92Cb5BSpXBKd4Eaysvkm5ex77I5Y1Hl0RUjyEiegiwC1LrcrFhjhVFQGlShTr5kf/LJrwamyGJx4oLi462Omf/jLwNoIMLNgxzuJBynYK714AY9U/IbNq//bEQro6i2cwxPm4lSTaGemnhvEItHsDfbeAJ06iqOl51OtsM2qees2ygCgFvraKNRTmOoRkhS/IwC1bqoMqR8uraYcfKlXeXBjYnJbVG6u/SAGLg7Llmt5UAs7a6/W/7ytWJ90uQVjgPcb7h+9ji+jK18EQUd/AAknfLkLE5IoU5wj6+2OTAGeCT46BbMpYOk2RJinUy93VBIPuRyvZ5tdIt76BPt3JgosYbYtbdkyZTI8V72iCVLWae1uCF2pJlZ1gLteaS0ZmkgyEsAchm8VaoE8NrIO4MBpyZ3fZ9gsprT5jsnUb9Hc+opKSgX+OwDjzM5BadCUFtvoJE3FNTv7koIDg2myHyYj+1kFxp6ctjNgP9V9/0rc4oWz9ew== grey@kitagawa" ];

  services.openssh = {
    enable = true;
    enableRecommendedAlgorithms = false;
    generateHostKeys = false;
    settings = {
      AllowUsers = [ "grey" ];
      KbdInteractiveAuthentication = false;
      PasswordAuthentication = false;
      PermitRootLogin = "no";
      MaxAuthTries = 3;
      MaxSessions = 5;
      MaxStartups = "2:50:5";
    };
    startWhenNeeded = true;
  };

  networking.firewall.extraCommands = ''
    if [ "$(iptables -S INPUT)" != "-P INPUT ACCEPT" ]; then iptables -D INPUT -p tcp --dport 22 -m set ! --match-set geo-whitelist src -j DROP; ${pkgs.ipset}/bin/ipset destroy geo-whitelist; fi
    ${pkgs.ipset}/bin/ipset restore -file /home/grey/nixos/assets/geo-whitelist.ipset
    iptables -I INPUT -p tcp --dport 22 -m set ! --match-set geo-whitelist src -j DROP
  '';
}