The RFC 42 settings option derives the Host/Match line from the
attribute name. That makes it impossible to express headers that carry
Nix string context (e.g. Match exec referring to a store path), and
forces long computed patterns into attribute names where a stable
logical name would be nicer for dag ordering.
Add an explicit `header` option on each block that defaults to the
attribute name (with the existing Host/Match prefix detection), and
have the legacy matchBlocks shim populate it instead of the
__hmSshBlockHeader internal.
Add programs.ssh.settings as a freeform DAG for OpenSSH client configuration blocks. Render Host and Match blocks directly from the new settings option while preserving ordering support.
Render known ssh_config comma-list directives from Nix lists as single comma-separated lines and known space-list directives as single whitespace-separated lines. This keeps directives like KexAlgorithms, Ciphers, MACs, HostKeyAlgorithms, ProxyJump, SendEnv, GlobalKnownHostsFile, and PermitRemoteOpen from being emitted as duplicate directives where OpenSSH may only use the first value.
Migrate legacy matchBlocks into settings, keep root SSH option redirects pointed at the new option names, and hide the deprecated matchBlocks option from generated docs.
Update SSH tests, docs references, and news coverage for the new option.
A first step towards refactoring the module.
Unfortunately the config is not consistent in using comma-separated
values or repeated keys for lists, since the user can always add commas
by themselves, we should default to repeated keys in the generator.
Make use of the recently added nullable `mkPackageOption` feature
to disable installing an SSH client by default: most people should use
the client provided by their system.
* ssh: add generic Match support for matchBlocks
Introduce conservative support for actual `Match`
blocks in ssh config.
"Conservative" means this PR doesn'tt try to process
the `match` expression and simply uses it as a string
provided by the user.
If set, `match` has precedence over `host` meaning
if both are set, `match` is used and `host` is ignored.
* Add news entry
This switches the type of `matchBlocks` from `loaOf` to `listOrDagOf`.
The former has been deprecated in Nixpkgs. The latter allows
dependencies between entries to be expressed using the DAG functions.
