diff --git a/lotus-land-story/main.yml b/lotus-land-story/main.yml
index e94f12e..0633198 100644
--- a/lotus-land-story/main.yml
+++ b/lotus-land-story/main.yml
@@ -52,7 +52,7 @@
 - import_playbook: miniflux.yml    # noqa: name[play]
 - import_playbook: gotosocial.yml  # noqa: name[play]
 - import_playbook: caddy.yml       # noqa: name[play]
-- import_playbook: ufw.yml         # noqa: name[play]
+- import_playbook: security.yml    # noqa: name[play]
 - import_playbook: backup.yml      # noqa: name[play]
 - import_playbook: prometheus.yml  # noqa: name[play]
 
diff --git a/lotus-land-story/ufw.yml b/lotus-land-story/security.yml
similarity index 62%
rename from lotus-land-story/ufw.yml
rename to lotus-land-story/security.yml
index 3a9442f..e69e151 100644
--- a/lotus-land-story/ufw.yml
+++ b/lotus-land-story/security.yml
@@ -1,5 +1,4 @@
-- name: Set up ufw
-  hosts: lotus-land-story
+- hosts: lotus-land-story
   tasks:
 
     - name: Enable ufw
@@ -23,6 +22,20 @@
         from_ip: "{{ docker_network.network.IPAM.Config[0].Subnet }}"
       notify: Reload ufw
 
+    # for gitea from work laptop
+    - name: Allow SSH access
+      community.general.ufw:
+        rule: allow
+        name: OpenSSH
+      notify: Reload ufw
+
+    - name: Disable password auth via SSH
+      ansible.builtin.lineinfile:
+        path: /etc/ssh/sshd_config
+        regexp: ^PasswordAuthentication
+        line: PasswordAuthentication no
+      notify: Restart ssh
+
   handlers:
     - name: Import restarts
       ansible.builtin.import_tasks: restarts.yml