{
  services.openssh.extraConfig = ''
    Match Group sftponly
      ChrootDirectory /sftp_jail
      ForceCommand internal-sftp
      AllowTcpForwarding no
  '';

  users.groups.sftponly = {};
}