[app] only enable SSH when instance is running