···21212222 services.openssh.extraConfig = ''
2323 # For all users except git, only allow from LAN and Tailscale
2424- Match User * Address !192.168.4.0/22,!100.64.0.0/10,!127.0.0.1
2525- DenyUsers *,!git
2424+ Match Address !192.168.4.0/22,!100.64.0.0/10,!127.0.0.1
2525+ Match User !git
2626+ DenyUsers *
2627 '';
27282829 system.autoUpgrade = {