diff --git a/hosts/common/ssh.nix b/hosts/common/ssh.nix
index b763ee22..7872eadb 100644
--- a/hosts/common/ssh.nix
+++ b/hosts/common/ssh.nix
@@ -30,4 +30,11 @@ in
     })
     (globalKeys ++ domainKeys)
   );
+
+  services.openssh = {
+    enable = true;
+    settings.PermitRootLogin = "no";
+    settings.PasswordAuthentication = false;
+  };
+  sane.services.wan-ports.tcp = [ 22 ];
 }
diff --git a/hosts/common/users.nix b/hosts/common/users.nix
index 9e2e4cc8..4e67fba4 100644
--- a/hosts/common/users.nix
+++ b/hosts/common/users.nix
@@ -129,11 +129,5 @@ in
       enable = true;
       wheelNeedsPassword = false;
     };
-
-    services.openssh = {
-      enable = true;
-      settings.PermitRootLogin = "no";
-      settings.PasswordAuthentication = false;
-    };
   };
 }