nixfiles/profiles/sshd/sshd.nix

{...}: {
    services.openssh.enable = true;
    services.openssh.permitRootLogin = "prohibit-password";
}