# SSH Configuration Template (~/.ssh/config)
# Documentation:
#   man ssh_config
#   https://www.openssh.com/manual.html
#
# OpenSSH has no XDG layout — client state stays under ~/.ssh (official).
# First obtained value wins: Include conf.d before Host * so host snippets
# can override defaults (IdentityFile, IdentitiesOnly, …).
#
# conf.d/1password.conf (infra setup 1password on macOS) documents why NOT to set
# IdentityAgent in ssh config (breaks sandboxed CLIs). Use ssh-agent / Keychain.

# Host-specific snippets (github, 1password, jumps, …)
Include conf.d/*.conf

Host *
    # Keep connections alive
    ServerAliveInterval 60
    ServerAliveCountMax 10

    # Multiplexing: reuse existing connections
    ControlMaster auto
    ControlPath ~/.ssh/sockets/%r@%h-%p
    ControlPersist 10m

    # Security: prefer public-key; disable password auth by default
    PasswordAuthentication no
    PubkeyAuthentication yes

    # macOS Keychain / ssh-agent (default; do not override with 1Password IdentityAgent)
    IgnoreUnknown UseKeychain,AddKeysToAgent,IdentityAgent
    AddKeysToAgent yes
    UseKeychain yes

    # Forward Agent for jump hosts (use with caution)
    # ForwardAgent yes
