{ config, lib, ... }:
let
  # 与 modules/core/sops.nix 保持同一开关：secrets 文件存在时才启用。
  secretsEnabled = builtins.pathExists ../../secrets/users/luochen570.enc.yaml;
in
{
  programs.ssh.enable = true;
  # 26.05: 显式关闭默认配置生成，避免未来默认值移除警告
  programs.ssh.enableDefaultConfig = false;

  home.file = lib.mkIf secretsEnabled {
    # ~/.ssh/id_rsa 来自 sops secret 文件。
    ".ssh/id_rsa".source =
      config.lib.file.mkOutOfStoreSymlink "/run/secrets/users/luochen570/ssh_private_key";

    # ~/.ssh/config 来自 sops secret 文件。
    ".ssh/config".source =
      config.lib.file.mkOutOfStoreSymlink "/run/secrets/users/luochen570/ssh_config";
  };
}