{ pkgs, ... }:

{
  # Сервер OpenSSH с усиленной безопасностью
  services.openssh = {
    enable = true;

    settings = {
      # Аутентификация
      PasswordAuthentication = false;
      PubkeyAuthentication = true;
      PermitRootLogin = "no";
      KbdInteractiveAuthentication = false;
      ChallengeResponseAuthentication = false;
      PermitEmptyPasswords = false;

      # Сессии и доступ
      LoginGraceTime = 30;
      MaxAuthTries = 3;
      MaxSessions = 2;
      ClientAliveInterval = 300;
      ClientAliveCountMax = 2;

      # Отключить устаревшие возможности
      X11Forwarding = false;
      AllowAgentForwarding = false;
      PermitUserEnvironment = false;
    };

    # Дополнительная конфигурация
    extraConfig = ''
      # Authentication methods
      AuthenticationMethods publickey

      # Reduce legacy or risky features
      IgnoreRhosts yes
      HostbasedAuthentication no
      TCPKeepAlive no

      # Connection throttling
      MaxStartups 10:30:60
    '';
  };

  # Агент GnuPG
  programs.gnupg.agent = {
    enable = true;
    enableSSHSupport = true;
  };

  # MTR для сетевой диагностики
  programs.mtr.enable = true;

  # Firefox
  programs.firefox.enable = true;

  # AmneziaVPN
  programs.amnezia-vpn.enable = true;

  # Системные пакеты
  environment.systemPackages = with pkgs; [
    amneziawg-tools
    neofetch
  ];
}