{ config, lib, pkgs, ... }:
with lib; {
  config = {
    programs.ssh = mkIf (!config.home.isolation.active) {
      enable = true;

      compression = true;
      controlMaster = "autoask";
      controlPath = "/run/user/%i/ssh/master-%r@%n:%p";

      extraOptionOverrides.AddKeysToAgent = "true";

      matchBlocks = import ./match.nix;
    };

    systemd.user.tmpfiles.rules = [
      "d %t/ssh 0700"
    ];
  };
}