home: introduce ssh module that enables defining multi-proxy targets

also defines some good defaults for ssh.
workmac config already refactored. desktop config tbd.

home/modules/ensureDirs.nix

@@ -0,0 +1,66 @@
+{ config, lib, ... }:
+
+let
+  cfg = config.home.ensureDirs;
+
+  enabledDirs = lib.filterAttrs (_: opts: opts.enable) cfg;
+
+  dirType = lib.types.submodule (
+    { name, ... }:
+    {
+      options = {
+        enable = lib.mkEnableOption "this directory" // {
+          default = true;
+        };
+
+        path = lib.mkOption {
+          type = lib.types.str;
+          default = name;
+          description = "Directory path relative to $HOME. Defaults to the attribute name.";
+        };
+
+        mode = lib.mkOption {
+          type = lib.types.str;
+          default = "755";
+          description = "Octal permissions to set on the directory.";
+        };
+      };
+    }
+  );
+
+  activationScript = builtins.concatStringsSep "\n" (
+    lib.mapAttrsToList (_: opts: ''
+      run mkdir -p "$HOME/${opts.path}"
+      run chmod ${opts.mode} "$HOME/${opts.path}"
+    '') enabledDirs
+  );
+
+in
+{
+  options.home.ensureDirs = lib.mkOption {
+    type = lib.types.attrsOf dirType;
+    default = { };
+    description = ''
+      Set of directories (relative to $HOME) to create with specific
+      permissions on every home-manager activation. Works on both
+      Linux and Darwin. The attribute name defaults as the directory
+      path but can be overridden via the `path` option.
+    '';
+    example = lib.literalExpression ''
+      {
+        ".ssh"               = { mode = "700"; };
+        ".gnupg"             = { mode = "700"; };
+        ".local/share/myapp" = { mode = "700"; };
+        "projects"           = {};
+        "my-workspace" = {
+          path = "work/projects";
+          mode = "750";
+        };
+      }
+    '';
+  };
+
+  config = lib.mkIf (enabledDirs != { }) {
+    home.activation.ensureDirs = lib.hm.dag.entryAfter [ "writeBoundary" ] activationScript;
+  };
+}