{ lib, config, ... }:
let
  cfg = config.py.programs.ssh;
in
{
  options.py.programs.ssh.enable = lib.mkEnableOption "ssh";
  config = lib.mkIf cfg.enable {
    programs.ssh = {
      enable = true;
      enableDefaultConfig = false;
      settings = {
        "*" = {
          ForwardAgent = false;
          AddKeysToAgent = "no";
          ServerAliveInterval = 0;
          ServerAliveCountMax = 3;
          HashKnownHosts = false;
          UserKnownHostsFile = "~/.ssh/known_hosts";
          ControlMaster = "no";
          ControlPath = "~/.ssh/master-%r@%n:%p";
          ControlPersist = "no";
          Compression = true;
        };
        "marvin" = {
          Hostname = "100.123.15.72";
          User = "thehedgehog";
          Port = 22;
          IdentitiesOnly = false;
          PreferredAuthentications = "publickey";
        };
        "prefect" = {
          Hostname = "100.107.252.71";
          User = "thehedgehog";
          Port = 22;
          IdentitiesOnly = false;
          PreferredAuthentications = "publickey";
        };
        "test-vm" = {
          Hostname = "localhost";
          User = "root";
          Port = 2222;
          StrictHostKeyChecking = false;
          PreferredAuthentications = "password";
        };
      };
      extraOptionOverrides = {
        "Match" = ''host * exec "gpg-connect-agent UPDATESTARTUPTTY /bye"'';
      };
    };
    home.file.".ssh/authorized_signatures".text = import ./ssh-auth-signers.nix;
  };
}