diff --git a/hosts/ryzen9.nix b/hosts/ryzen9.nix
index 0ee7732..252af5b 100644
--- a/hosts/ryzen9.nix
+++ b/hosts/ryzen9.nix
@@ -113,10 +113,16 @@
   services = {
     openssh = {
       enable = true;
-      permitRootLogin = "no";
+      # permitRootLogin = "no"; -- distributed-build.nix requires it
       passwordAuthentication = false;
     };
-    fail2ban.enable = true;
+    fail2ban = {
+      enable = true;
+      ignoreIP = [
+        # quebec
+        "70.53.187.43"
+      ];
+    };
 
     netdata.enable = true;
   };