{ lib, ... }:
{
  programs.ssh.enableDefaultConfig = false;
  services.ssh-agent.enable = true;

  home.activation.writeSSHConfig = lib.hm.dag.entryAfter [ "writeBoundary" ] ''
    rm -f $HOME/.ssh/config
    cat > $HOME/.ssh/config <<EOF
      Host tangled-handle
      IdentitiesOnly yes
      User git
      HostName tangled.sh
      IdentityFile ~/.ssh/id_ed25519_handle

      Host tangled.sh
      IdentitiesOnly yes
      User git
      HostName tangled.sh
      IdentityFile ~/.ssh/id_ed25519
    EOF

    chmod 600 $HOME/.ssh/config
  '';
}