Starts reading with /etc/ssh/sshd.d directory which can provide admins to give/takeaway what user can specify in their user config files then OpenSSH reads in the user-defined configuration in $HOME/.ssh/sshd.d.

Inserting configuration items into system config directory takes away user's ability to use nor change.

Removing from system directory reverts to a user-changeable default settings. Adding to user-directory (without any in system directory) gives user that choice.

For finer granularity of option usage, remove said option from both system directory and user config files then insert into last of lexical ordering config files (typically 99-something.conf or 999-something.conf) and place a couple under Match/MatchGroup using deny/accept.

Yeah a good templating language will allow you to apply conditionals but honestly, it’s just generally easier to have different files inside a config directory than have to manage all these different use cases in a single monolithic template or multiple different templates in which you need to remember to keep shared components in sync.

At the end of the day, we aren’t talking about solving problems that were impossible before but rather solving problems that were just annoying. It’s more a quality of life improvement than something that couldn’t be otherwise solved with enough time and effort.

I don't grep this argument at all. It feels like everyone's comparing to that "regular [bad] detergent" in this thread. A templating system will be as good and as error-prone to change and as modular etc as you make it, just like any program.

It applies only to local patchers (like e.g. certbot nginx) and manual changes, but that's exactly out of scope of templating and configuration automation. So it can't be better, cause these two things are in XOR relationships.

Edit to clarify: I don't disagree with foo.d approach in general. I just don't get the arguments that in automation setting it plays any positive role, when in fact you may step on a landmine by only writing your foo.d/00-my. Your DC might have put some crap into foo.d/{00,99}-cloud, so you have to erase and re-create the whole foo.d anyway. Or at least lock yourself into a specific cloud.

    I/O is done piecewise, a line at a time. The file is never "loaded up". Again
    you're applying an intuition about how parsers are presented to college
    students (suck it all into RAM and build a big in-memory representation of
    the syntax tree) that doesn't match the way actual config file parsers work
    (read a line and interpret it, then read another).

The complexity of the algorithm is about the same, either the early exit is here or it isn't (in fact, the version with the early exit, now that I think of it, has larger cyclotomatic complexity but whatever).

As you say, I am used to checking the docs in Linux. It’s the convention that no convention shall be assumed. Is that good design?

My point is that intuitive is as not as subjective as you make it out to be. Which is partially reinforced by a lot of software where "last one wins" is the policy. This example here sticks out like a sore thumb.

No point pursuing however because you seem hellbent on defending tradition which is something that tires and bores me.

Just agree to disagree, move on.

> Why would "last one wins" be dumbing down the tool, exactly?

I did not refer to that as dumbing down the tool. That said, if you are unsure whether it is first or last one wins, read the documentation. There is no objective intuition here. To me "first one wins" might be intuitive TO YOU, but to me "last one wins" is.

> You're doing a big assumption that people are averse to reading documentation.

Some people definitely are, and they openly tell you that on here, too.

If you look further into my comments where I discuss "strtok", you will see it for yourself.

> You are likely downvoted because you prefer to make your opponents look irrational so you can easily defeat them.

I got down-voted because I claimed strtok is straightforward to use once you have read the documentation. I do not see how I am making them look irrational either (nor is it my intention). I am just trying to encourage people to read the documentation.