{ customUtils, lib, config, hostName, pkgs, ... }:
{
  config = {
    programs.ssh.knownHosts = lib.zipAttrsWith (_name: values: builtins.head values) (lib.mapAttrsToList (name: lib.mapAttrs' (type: value: lib.nameValuePair "${name}-${type}" value)) (customUtils.nixImport { dir = ./known-hosts; }));

    systemd.user.services."ssh-agent".enable = lib.mkForce false; # ssh-agent should be done via home-manager

    services.openssh = lib.mkIf config.services.openssh.enable {
      hostKeys = [
        { path = "/etc/ssh/ssh_host_rsa_key";
          type = "rsa";
        }
        { path = "/etc/ssh/ssh_host_ed25519_key";
          type = "ed25519";
        }
      ];
      ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes256-ctr" ];
      macs = [ "hmac-sha2-256-etm@openssh.com" "hmac-sha2-256" "hmac-sha2-512-etm@openssh.com" "hmac-sha2-512" ];
      kexAlgorithms = [ "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ];
      moduliFile = config.sops.secrets.ssh_moduli.path;
      extraConfig = ''
        HostKeyAlgorithms sk-ssh-ed25519-cert-v01@openssh.com,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512-cert-v01@openssh.com,sk-ssh-ed25519@openssh.com,ssh-ed25519,rsa-sha2-256,rsa-sha2-512
      '';
      logLevel = "VERBOSE";
    };

    programs.ssh = {
      ciphers = [ "chacha20-poly1305@openssh.com" "aes256-gcm@openssh.com" "aes256-ctr" ];
      hostKeyAlgorithms = [ "sk-ssh-ed25519-cert-v01@openssh.com" "ssh-ed25519-cert-v01@openssh.com" "rsa-sha2-256-cert-v01@openssh.com" "rsa-sha2-512-cert-v01@openssh.com" "sk-ssh-ed25519@openssh.com" "ssh-ed25519" "rsa-sha2-256" "rsa-sha2-512" ];
      kexAlgorithms = [ "curve25519-sha256@libssh.org" "diffie-hellman-group-exchange-sha256" ];
      macs = [ "umac-128-etm@openssh.com" "hmac-sha2-256-etm@openssh.com" "hmac-sha2-512-etm@openssh.com" "umac-128@openssh.com" "hmac-sha2-256" "hmac-sha2-512" "umac-64-etm@openssh.com" "umac-64@openssh.com"];
      pubkeyAcceptedKeyTypes = [ "ssh-ed25519" "ssh-rsa" ];
      extraConfig = ''
        Host *
          UseRoaming no
      '';
    };

    sops.secrets = lib.mkIf config.services.openssh.enable {
      ssh_host_rsa_key = {
        key = "rsa";
        path = "/etc/ssh/ssh_host_rsa_key";
        sopsFile = ./host-keys + "/${hostName}.yaml";
      };
      ssh_host_ed25519_key = {
        key = "ed25519";
        path = "/etc/ssh/ssh_host_ed25519_key";
        sopsFile = ./host-keys + "/${hostName}.yaml";
      };
      ssh_moduli = {
        format = "binary";
        path = "/etc/ssh/moduli";
        sopsFile = ./host-moduli + "/${hostName}";
      };
    };

    environment.etc = lib.mkIf config.services.openssh.enable {
      "ssh/ssh_host_rsa_key.pub".text = config.services.openssh.knownHosts."${hostName}-rsa".publicKey;
      "ssh/ssh_host_ed25519_key.pub".text = config.services.openssh.knownHosts."${hostName}-ed25519".publicKey;
    };

    environment.systemPackages = lib.mkIf config.services.openssh.enable (with pkgs; [
      rxvt_unicode.terminfo alacritty.terminfo
    ]);
  };
}