···21212222 services.openssh.extraConfig = ''
2323 # For all users except git, only allow from LAN and Tailscale
2424- Match Address !192.168.4.0/22,!100.64.0.0/10,!127.0.0.1
2525- Match User !git
2626- DenyUsers *
2424+ AllowUsers git *@192.168.4.0/22 *@100.64.0.0/10 *@127.0.0.1
2725 '';
28262927 system.autoUpgrade = {