{{ if eq (default "host" (index . "machineRole")) "canonical" }}
Include config.local
Host *
  HashKnownHosts yes
  ForwardAgent no
  ServerAliveInterval 120
{{ else }}
# Ensure KnownHosts are unreadable if leaked
HashKnownHosts yes

Compression no
ControlMaster auto
ControlPersist 10
AddressFamily inet
ServerAliveInterval 120
IdentitiesOnly yes

Host git.sommerfeld.dev
  Hostname mandibles.wg

Include work.config

Match host * exec "gpg-connect-agent UPDATESTARTUPTTY /bye"

Match host *.wg,*.pulpo
  IdentityFile ~/.ssh/nym.pub
{{ end }}