{ pkgs, ... }:
let
  git = "~/.ssh/git";
in
{
  programs.ssh = {
    enable = true;
    package = pkgs.openssh_gssapi;
    compression = true;
    controlMaster = "auto";
    controlPersist = "10m";
    extraConfig = ''
      CanonicalizeHostname yes
      CanonicalDomains agdsn.network vpn.rfive.de
      PKCS11Provider /run/current-system/sw/lib/libtpm2_pkcs11.so
      IdentityFile ~/.ssh/id_ed25519
      SetEnv TERM=xterm-256color
      VisualHostKey = yes
    '';
    matchBlocks = {
      # Personal
      "git@github.com" = {
        match = "Host github.com User git";
        identityFile = git;
      };
      "git@git.sr.ht" = {
        match = "Host git.sr.ht User git";
        identityFile = git;
      };
      "*.vpn.rfive.de" = {
        user = "root";
      };

      # TU Dresden
      "tud" = {
        hostname = "login.zih.tu-dresden.de";
        user = "rose159e";
      };
      "mininet" = {
        hostname = "internet.netd.cs.tu-dresden.de";
        user = "root";
        port = 2133;
        extraOptions = {
          ProxyJump = "tud";
        };
      };

      # iFSR
      "quitte" = {
        hostname = "quitte.ifsr.de";
        user = "rouven.seifert";
      };
      "tomate" = {
        hostname = "tomate.ifsr.de";
        user = "rouven.seifert";
        extraOptions = {
          ProxyJump = "tud";
        };
      };
      "git@ifsr.de" = {
        match = "Host ifsr.de User git";
        identityFile = git;
      };

      # AG DSN
      "dijkstra" = {
        hostname = "login.agdsn.tu-dresden.de";
        user = "r5";
        extraOptions = {
          VerifyHostKeyDNS = "yes";
          GSSAPIAuthentication = "yes";
        };
      };
      "*.agdsn.network" = {
        user = "r5";
        extraOptions = {
          # ProxyJump = "dijkstra";
          VerifyHostKeyDNS = "yes";
          GSSAPIAuthentication = "yes";
        };
      };
      "git@git.agdsn.de" = {
        match = "Host git.agdsn.de User git";
        identityFile = git;
      };
    };
  };
}