{ ... }:
let
  git = "~/.ssh/git";
in
{
  programs.ssh = rec {
    enable = true;
    compression = true;
    controlMaster = "auto";
    controlPersist = "10m";
    extraConfig = ''
      CanonicalizeHostname yes
      CanonicalDomains agdsn.network ifsr.de
      PKCS11Provider /run/current-system/sw/lib/libtpm2_pkcs11.so
      IdentityFile ~/.ssh/id_ed25519
      VisualHostKey = yes
    '';
    matchBlocks = {
      # personal use
      "github.com" = {
        identityFile = git;
      };
      "rfive.de" = {
        hostname = "falkenstein.vpn.rfive.de";
        user = "root";
        port = 2222;
        extraOptions = {
          VerifyHostKeyDNS = "ask";
        };
      };
      # used for nix remote building
      falkenstein-1 = matchBlocks."rfive.de";

      "nuc" = {
        hostname = "192.168.42.2";
        user = "root";
      };

      "router" = {
        hostname = "192.168.42.1";
        user = "root";
      };

      # iFSR
      "fsr" = {
        hostname = "ifsr.de";
        user = "rouven.seifert";
      };
      "*.ifsr.de" = {
        user = "root";
      };
      "git@ifsr.de" = {
        match = "Host ifsr.de User git";
        identityFile = git;
      };

      # AG DSN
      "dijkstra" = {
        hostname = "login.agdsn.tu-dresden.de";
        user = "r5";
      };
      "*.agdsn.network" = {
        user = "r5";
        extraOptions = {
          ProxyJump = "dijkstra";
        };
      };
      "git@git.agdsn.de" = {
        match = "Host git.agdsn.de User git";
        identityFile = git;
      };
    };
  };
}