.

configuration.nix

@@ -76,6 +76,18 @@
     #   };
     # };
     tailscale.enable = true;
+    openssh = {
+      enable = true;
+      ports = [ 22 ];
+      settings = {
+        PasswordAuthentication = false;
+        KbdInteractiveAuthentication = false;
+        PermitRootLogin = "no";
+        AllowUsers = [
+          "user"
+        ];
+      };
+    };
   };
 
   hardware = {
@@ -139,5 +151,12 @@
       };
     };
   };
-  services.openssh.enable = true;
+
+  systemd.tmpfiles.rules = [
+    "d /home/public         2775 root public - -"
+    "d /home/public/pictures 2775 root public - -"
+
+    "a+ /home/public          - - - - d:g:public:rwX,d:m::rwX"
+    "a+ /home/public/pictures - - - - d:g:public:rwX,d:m::rwX"
+  ];
 }