Only bind mysql to the localhost address

That way its not addressable from outside.

anythingforafriend/etc/nixos/configuration.nix

@@ -18,7 +18,13 @@
   ];
   i18n.defaultLocale = "en_US.UTF-8";
   nix.settings.experimental-features = [ "nix-command" "flakes" ];
-
+  nixpkgs.config = {
+    packageOverrides = pkgs: {
+      unstable = import <nixpkgs-unstable> {
+        config = config.nixpkgs.config;
+      };
+    };
+  };
   programs.neovim.enable = true;
   programs.neovim.defaultEditor = true;
 
@@ -64,6 +70,7 @@
   services.mysql = {
     enable = true;
     package = pkgs.mariadb;
+    settings.mysqld.bind-address = "127.0.0.1";
   };
   services.nginx = {
     enable = true;
@@ -105,6 +112,7 @@
   services.openssh = {
     enable = true;
     # require public key authentication for better security
+    package = pkgs.unstable.openssh;
     settings.PasswordAuthentication = false;
     settings.KbdInteractiveAuthentication = false;
     settings.PermitRootLogin = "no";