{config, ...}: {
  programs.ssh = {
    enable = true;

    controlMaster = "auto";
    controlPath = "~/.ssh/controlmasters/%r@%h:%p";
    controlPersist = "300s";
    serverAliveInterval = 30;
    matchBlocks = {
      "Host *redalder.org 10.64.1.* 10.64.0.*".extraOptions = {
        ExitOnForwardFailure = "yes";
        SendEnv = "INSIDE_EMACS";
        RemoteForward = "/home/main/.ssh/emacs-server /run/user/1000/emacs/server";
      };
    };
  };

  home.activation."ssh-controlmasters" = config.lib.dag.entryAfter ["writeBoundary"] ''
    mkdir -p ~/.ssh/controlmasters
  '';

  home.file.".profile".text = ''
    export SSH_AUTH_SOCK=$(gpgconf --list-dirs agent-ssh-socket)
  '';
}