{ ... }: {
  programs.ssh = {
    enable = true;
    compression = true;
    controlMaster = "auto";
    controlPersist = "10m";
    hashKnownHosts = true;
    serverAliveInterval = 15;
    extraConfig = ''
      VerifyHostKeyDNS ask
      CanonicalizeHostname yes
      CanonicalizeFallbackLocal no
      CanonicalizeMaxDots 0
      CanonicalDomains home.arpa hydra-pinecone.ts.net
      IdentitiesOnly yes
    '';
    includes = [
      "local.ssh_config"
    ];
  };
}