{ ... }:
{
  programs.ssh = {
    enable = true;
    enableDefaultConfig = false;
    matchBlocks."*" = {
      compression = true;
      controlMaster = "auto";
      controlPersist = "10m";
      serverAliveInterval = 15;
    };
    extraConfig = ''
      SendEnv TERM_PROGRAM
      VerifyHostKeyDNS ask
      CanonicalizeHostname yes
      CanonicalizeFallbackLocal no
      CanonicalizeMaxDots 0
      CanonicalDomains home.arpa fin-marlin.ts.net
      IdentitiesOnly yes
      StrictHostKeyChecking yes
    '';
    includes = [
      "local.ssh_config"
    ];
  };
  home.shellAliases = {
    essh = "ssh -o StrictHostKeyChecking=no -o GlobalKnownHostsFile=/dev/null -o UserKnownHostsFile=/dev/null";
  };
}