{
  pkgs,
  lib,
  config,
  ...
}: let
  program = "ssh";
  cfg = config.dots.${program};
  #sec = sops.secrets;
in {
  options.dots.${program} = {
    enable = lib.mkEnableOption "enables ${program}";
  };

  config = lib.mkIf cfg.enable {
    programs.ssh = {
      enable = true;
      #enableDefaultConfig = false;
      matchBlocks = {
        "git.blakedheld.xyz" = {
          user = "gitea";
          identityFile = "~/.ssh/id_snowbelle";
        };
        "git.snowbelle.lan" = {
          user = "gitea";
          identityFile = "~/.ssh/id_snowbelle";
        };
        "bebe" = {
          hostname = "10.10.0.1";
          user = "root";
          identityFile = "~/.ssh/id_snowbelle";
        };
      };
    };

    # import sshkeys from keyring
    #home.file.".ssh/id_snowbelle".source = config.lib.file.mkOutOfStoreSymlink /home/blake/.nix/.keyring/ssh/id_snowbelle;
    #home.file.".ssh/id_snowbelle.pub".source = config.lib.file.mkOutOfStoreSymlink /home/blake/.nix/.keyring/ssh/id_snowbelle.pub;

    # manage secrets with sops
    sops.secrets = {
      "id_snowbelle" = {
        mode = "0600";
        path = "/home/blake/.ssh/id_snowbelle";
      };
      "id_snowbelle.pub" = {
        mode = "644";
        path = "/home/blake/.ssh/id_snowbelle.pub";
      };
    };
  };
}
