{ ... }:
{
  programs.ssh = {
    enable = true;
    enableDefaultConfig = false;
    matchBlocks."*" = {
      compression = true;
      controlMaster = "auto";
      controlPersist = "10m";
      hashKnownHosts = true;
      serverAliveInterval = 15;
    };
    extraConfig = ''
      VerifyHostKeyDNS ask
      CanonicalizeHostname yes
      CanonicalizeFallbackLocal no
      CanonicalizeMaxDots 0
      CanonicalDomains home.arpa hydra-pinecone.ts.net
      IdentitiesOnly yes
    '';
    includes = [
      "local.ssh_config"
    ];
  };
}