home: introduce ssh module that enables defining multi-proxy targets

also defines some good defaults for ssh.
workmac config already refactored. desktop config tbd.

home/modules/ensureDirs.nix

@@ -0,0 +1,66 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.home.ensureDirs;
+
+  enabledDirs = lib.filterAttrs (_: opts: opts.enable) cfg;
+
+  dirType = lib.types.submodule (
+    { name, ... }:
+    {
+      options = {
+        enable = lib.mkEnableOption "this directory" // {
+          default = true;
+        };
+
+        path = lib.mkOption {
+          type = lib.types.str;
+          default = name;
+          description = "Directory path relative to $HOME. Defaults to the attribute name.";
+        };
+
+        mode = lib.mkOption {
+          type = lib.types.str;
+          default = "755";
+          description = "Octal permissions to set on the directory.";
+        };
+      };
+    }
+  );
+
+  activationScript = builtins.concatStringsSep "\n" (
+    lib.mapAttrsToList (_: opts: ''
+      run mkdir -p "$HOME/${opts.path}"
+      run chmod ${opts.mode} "$HOME/${opts.path}"
+    '') enabledDirs
+  );
+
+in
+{
+  options.home.ensureDirs = lib.mkOption {
+    type = lib.types.attrsOf dirType;
+    default = { };
+    description = ''
+      Set of directories (relative to $HOME) to create with specific
+      permissions on every home-manager activation. Works on both
+      Linux and Darwin. The attribute name defaults as the directory
+      path but can be overridden via the `path` option.
+    '';
+    example = lib.literalExpression ''
+      {
+        ".ssh"               = { mode = "700"; };
+        ".gnupg"             = { mode = "700"; };
+        ".local/share/myapp" = { mode = "700"; };
+        "projects"           = {};
+        "my-workspace" = {
+          path = "work/projects";
+          mode = "750";
+        };
+      }
+    '';
+  };
+
+  config = lib.mkIf (enabledDirs != { }) {
+    home.activation.ensureDirs = lib.hm.dag.entryAfter [ "writeBoundary" ] activationScript;
+  };
+}

home/modules/ssh.nix

@@ -0,0 +1,110 @@
+{
+  pkgs,
+  inputs,
+  config,
+  lib,
+  ...
+}:
+let
+  inherit (lib) types;
+  controlDir = "~/.ssh/controlmasters";
+
+  proxyTagType = types.submodule (
+    { name, ... }:
+    {
+      options = {
+        after = lib.mkOption {
+          type = types.nullOr (types.listOf types.str);
+          default = [ ];
+          description = "List of other hm.dag.entryAfter conditions the match rule needs to be placed.";
+        };
+        # XXX extra args
+        connectType = lib.mkOption {
+          type = types.listOf (
+            types.enum [
+              "all"
+              "nomaster"
+              "master"
+              "direct"
+              "indirect"
+            ]
+          );
+          description = ''
+            Select jump indirection mode:
+            all|nomaster|{master,direct,indirect}
+            using ControlMaster socket, only directly, only through SSH if direct connections fail
+          '';
+        };
+        jumpHost = lib.mkOption {
+          type = types.nullOr types.str; # null is also okay for achieving hyppy eyeballs
+        };
+        noDirect = lib.mkEnableOption "Skip connecting to the remote host directly, always use the jump hosts";
+      };
+
+    }
+  );
+in
+{
+  imports = [
+    ./ensureDirs.nix
+  ];
+  options = {
+    programs.ssh.multi-proxy.tags = lib.mkOption {
+      type = types.attrsOf proxyTagType;
+      default = { };
+      description = "Set of ssh-multi-proxy target tag definitions.";
+    };
+  };
+  config = lib.mkIf config.programs.ssh.enable {
+    home.ensureDirs = {
+      ".ssh" = {
+        mode = "700";
+      };
+      ".ssh/controlmasters" = {
+        mode = "700";
+      };
+    };
+    home.packages = [ pkgs.fc-scripts.ssh-multi-proxy ];
+    programs.ssh = {
+      enableDefaultConfig = false; # deprecated
+      package = lib.mkDefault pkgs.openssh;
+      extraOptionOverrides = {
+        CanonicalizeHostname = "yes";
+        CanonicalizeFallbackLocal = "yes";
+      };
+      matchBlocks = {
+
+        # default, gets placed last by home-manager
+        "*" = {
+          serverAliveInterval = 10;
+          serverAliveCountMax = 2; # 2 strikes and you're out
+          forwardAgent = false;
+          addKeysToAgent = "no";
+          compression = false;
+          hashKnownHosts = false;
+          userKnownHostsFile = "~/.ssh/known_hosts";
+          controlMaster = "no";
+          controlPath = "${controlDir}/%r@%n:%p";
+          controlPersist = "no";
+        };
+      }
+      # ssh-multi-proxy tag definitions
+      // lib.mapAttrs' (
+        tag: tagDef:
+        let
+          dependency = if tagDef.after != null then lib.hm.dag.entryAfter tagDef.after else lib.id;
+        in
+        lib.nameValuePair "tagged-${tag}" {
+          match = ''tagged="${tag}"'';
+          proxyCommand = "${lib.getExe pkgs.fc-scripts.ssh-multi-proxy} -v -p connect --control-path='${controlDir}'${lib.optionalString tagDef.noDirect " -n"} -i ${lib.concatStringsSep "," tagDef.connectType}${
+            lib.optionalString (tagDef.jumpHost != null) " -j ${tagDef.jumpHost}"
+          } %h %p";
+          extraOptions = {
+            ProxyUseFdpass = "yes";
+          };
+        }
+      ) config.programs.ssh.multi-proxy.tags;
+    };
+
+  };
+}