{ config, ... }:
{
  # We do not use systemd's SSH proxy for local VMs or containers. Keeping its
  # generated config enabled also makes OpenSSH reject remotely imported store
  # paths whose files are owned by the Nix sandbox identity.
  programs.ssh.systemd-ssh-proxy.enable = false;

  programs.ssh.extraConfig = ''
    Host pinix
      HostName ${config.tailnetIPs.pinix}
      User drone
      IdentitiesOnly yes
      IdentityFile /home/drone/.ssh/id_ed25519

    # Mango travel router, pinix's LAN gateway. Only reachable via pinix,
    # never directly from blunix.
    Host mango
      HostName 192.168.8.1
      ProxyJump pinix

    Host eu.nixbuild.net
      PubkeyAcceptedKeyTypes ssh-ed25519
      ServerAliveInterval 60
      IPQoS throughput
      IdentityFile /home/drone/.ssh/id_ed25519
  '';

  programs.ssh.knownHosts.nixbuild = {
    hostNames = [ "eu.nixbuild.net" ];
    publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPIQCZc54poJ8vqawd8TraNryQeJnvH1eLpIDgbiqymM";
  };

  programs.ssh.knownHosts.pinix = {
    hostNames = [ "pinix" config.tailnetIPs.pinix ];
    publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBTIBiB9JYYtViI1IKK96pH+x3D63BQQgmZstc8jPBNp";
  };

  # Fetched via ssh-keyscan run directly on pinix (same physical LAN as
  # the router, not over an untrusted network); verified 29.07.2026.
  programs.ssh.knownHosts.mango = {
    hostNames = [ "mango" "192.168.8.1" ];
    publicKey = "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHynU8QHK4NyZdUmj70u1B4hpMMgENRmH5huGUAZoQZf";
  };

  nix.settings.trusted-public-keys = [
    "nixbuild.net/7M7RXY-1:cbc+CQirMbg9SlQxAatEYd4sZYXWOjN3OJi6sH+KK68="
  ];

  # Heavy builds opt in through --store ssh-ng://eu.nixbuild.net. Do not
  # register nixbuild.net as an automatic builder for ordinary builds.
}