_:
{
  programs.ssh = {
    enable = true;

    # Opt out of the soon-to-be-removed implicit `settings."*"` defaults.
    # They only ever matched OpenSSH's own defaults, so nothing is lost.
    enableDefaultConfig = false;

    # `settings` is a freeform block set: attribute names are Host/Match
    # patterns, values use OpenSSH directive names directly.
    settings = {
      "*" = {
        # Connection multiplexing — reuse one TCP/auth connection for
        # repeated ssh/git/scp to the same host. `%C` is a hash, so no
        # parent directory needs pre-creating.
        ControlMaster = "auto";
        ControlPath = "~/.ssh/control-%C";
        ControlPersist = "10m";

        # Keep idle sessions alive; drop genuinely dead ones after ~3 min.
        ServerAliveInterval = 60;
        ServerAliveCountMax = 3;

        # Load the key into the (gpg-)agent on first use — passphrase once
        # per session. Requires services.gpg-agent.enableSshSupport.
        AddKeysToAgent = "yes";
      };

      "yolo" = {
        HostName = "10.7.10.2";
        RemoteForward = [
          {
            bind.port = 9222;
            host.address = "localhost";
            host.port = 9222;
          }
        ];
        # localhost:417xx here -> yolo's listener on the same port.
        LocalForward = [
          {
            bind.port = 41700;
            host.address = "localhost";
            host.port = 41700;
          }
          {
            bind.port = 41701;
            host.address = "localhost";
            host.port = 41701;
          }
        ];
        # When yolo's listener is down, forwarded connections fail with
        # "channel N: open failed: connect failed: Connection refused".
        # QUIET silences those (and bind-in-use warnings) without affecting
        # the session itself; ExitOnForwardFailure stays at its default (no),
        # so a missing listener never blocks the connection.
        LogLevel = "QUIET";
      };
    };
  };
}