diff --git a/public/service-ssh.nix b/public/service-ssh.nix
index 33978b2..f332370 100644
--- a/public/service-ssh.nix
+++ b/public/service-ssh.nix
@@ -14,6 +14,7 @@ mkIf true {
   services.openssh = {
     enable = true;
     # https://wiki.mozilla.org/Security/Guidelines/OpenSSH#Modern_.28OpenSSH_6.7.2B.29
+    # http://www.cyberciti.biz/tips/linux-unix-bsd-openssh-server-best-practices.html
     extraConfig = ''
       KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
       Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr