{{- $wan := get . "giteaWanSsh" | trimPrefix "ssh://git@" | trimSuffix "/" -}}
{{- $lan := get . "giteaLanSsh" | trimPrefix "ssh://git@" | trimSuffix "/" -}}
{{- $wanParts := $wan | splitList ":" -}}
{{- $lanParts := $lan | splitList ":" -}}
{{- $wanHost := $wanParts | first -}}
{{- $lanHost := $lanParts | first -}}
{{- $wanPort := ternary ($wanParts | last) "22" (gt (len $wanParts) 1) -}}
{{- $lanPort := ternary ($lanParts | last) "22" (gt (len $lanParts) 1) -}}
# ~/.ssh/config -- PRIVATE tier. Mode 600.
#
# HOST ALIASES ONLY. No key material of any kind travels in this repository,
# in this tier or any other. Q3 is answered "sync public keys, not private":
#
#   travels      ~/.ssh/config, ~/.ssh/authorized_keys, ~/.ssh/pubkeys/*.pub
#   never        id_ed25519, id_rsa, *.pem, anything without a .pub suffix
#
# The IdentityFile lines below name a key this machine generates for itself:
#
#   ssh-keygen -t ed25519 -C "$(whoami)@$(hostname)"
#
# then paste ~/.ssh/id_ed25519.pub into GitHub and Gitea once. Ninety seconds
# per machine, and a private key never crosses a network. .chezmoiignore denies
# everything under .ssh/ by default and re-includes exactly three things, so a
# key generated tomorrow cannot be swept in by a careless `chezmoi add ~/.ssh`.

Host *
	AddKeysToAgent yes
	ServerAliveInterval 60
	ServerAliveCountMax 3
	HashKnownHosts no

Host github.com
	HostName github.com
	User git
	IdentityFile ~/.ssh/id_ed25519
	IdentitiesOnly yes
{{ if $wanHost }}
# Gitea over the WAN. A real hostname behind a real certificate; reachable
# from any network, which is what makes it the primary for both repos.
Host gitea {{ $wanHost }}
	HostName {{ $wanHost }}
	Port {{ $wanPort }}
	User git
	IdentityFile ~/.ssh/id_ed25519
	IdentitiesOnly yes
{{ end }}
{{- if $lanHost }}
# The same Gitea, reached over the LAN on a different port. Faster at home and
# the only route if the WAN name is down. A bare address on a private network:
# the single most obviously non-public line in this whole system.
Host gitea-lan {{ $lanHost }}
	HostName {{ $lanHost }}
	Port {{ $lanPort }}
	User git
	IdentityFile ~/.ssh/id_ed25519
	IdentitiesOnly yes
{{ end }}