From 1e19a0c7cbb87302bbe7fa6a60ad53738719a095 Mon Sep 17 00:00:00 2001
From: sommerfeld <sommerfeld@sommerfeld.dev>
Date: Tue, 22 Sep 2026 13:57:08 +0100
Subject: Default corporate SSH connections to the work identity

---
 private_dot_ssh/config.tmpl |  2 ++
 tests/test_canonical.py     | 26 ++++++++++++++++++++++++++
 2 files changed, 28 insertions(+)

diff --git a/private_dot_ssh/config.tmpl b/private_dot_ssh/config.tmpl
index 7bb6887..eb910d1 100644
--- a/private_dot_ssh/config.tmpl
+++ b/private_dot_ssh/config.tmpl
@@ -1,6 +1,8 @@
 {{ if eq (default "host" (index . "machineRole")) "canonical" }}
 Include config.local
 Host *
+  IdentityFile ~/.ssh/work.pub
+  IdentitiesOnly yes
   HashKnownHosts yes
   ForwardAgent no
   ServerAliveInterval 120
diff --git a/tests/test_canonical.py b/tests/test_canonical.py
index 76c61d1..1a8c5dd 100644
--- a/tests/test_canonical.py
+++ b/tests/test_canonical.py
@@ -207,6 +207,32 @@ class RoleTests(unittest.TestCase):
             subprocess.run(["sh", "-c", rendered], env=env, check=True)
             self.assertEqual(target.read_text(), '{"local": true}\n')
 
+    def test_canonical_defaults_to_work_git_and_ssh_identity(self):
+        git = subprocess.check_output(
+            self.command(
+                "canonical",
+                "execute-template",
+                "--file",
+                str(ROOT / "dot_config/git/config.tmpl"),
+            ),
+            text=True,
+        )
+        self.assertIn('email = "work@canonical.com"', git)
+        self.assertIn('name = "Work User"', git)
+        self.assertIn('signingkey = "' + "A" * 40 + '"', git)
+        self.assertNotIn("includeIf", git)
+        ssh = subprocess.check_output(
+            self.command(
+                "canonical",
+                "execute-template",
+                "--file",
+                str(ROOT / "private_dot_ssh/config.tmpl"),
+            ),
+            text=True,
+        )
+        self.assertIn("IdentityFile ~/.ssh/work.pub", ssh)
+        self.assertIn("IdentitiesOnly yes", ssh)
+
     def test_work_identity_is_rendered_without_personal_identity(self):
         for source in [
             "dot_config/git/config.tmpl",
-- 
cgit v1.3.1