add simple fail2ban, remove passwordauth for ssh

configuration.nix

@@ -110,7 +110,15 @@
 
   programs = {
     mosh.enable = true;
-    ssh.startAgent = true;
+    ssh = {
+      startAgent = true;
+      extraConfig = "
+        Host git.lo-probst.de
+          Hostname git.lo-probst.de
+          Port 23
+          User forgejo
+      ";
+    };
   };
   # Some programs need SUID wrappers, can be configured further or are
   # started in user sessions.
@@ -128,11 +136,15 @@
       enable = true;
       ports = [ 22 ];
       settings = {
-        PasswordAuthentication = true;
+        PasswordAuthentication = false;
         KbdInteractiveAuthentication = false;
         PermitRootLogin = "yes";
       };
     };
+    fail2ban = {
+      enable = true;
+      bantime = "12h";
+    };
   };
 
 #  services.nginx = {