diff --git a/defaults/main.yml b/defaults/main.yml
index 2f72262..031e0f2 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -38,3 +38,8 @@ hosts_entries: []
 hosts_file_snippets: []
 
 system_ipV6_disable: true
+
+system_ssh_custom_host:
+#  - host:
+#    user:
+#    keyfile:
diff --git a/tasks/ssh.yml b/tasks/ssh.yml
index 8a90100..12d5ad4 100644
--- a/tasks/ssh.yml
+++ b/tasks/ssh.yml
@@ -1,7 +1,7 @@
 - name: copy  ssh config for user
   become: true
-  copy:
-    dest: /home/{{ item }}/.ssh/
+  template:
+    dest: "/home/{{item}}/.ssh"
     src: "ssh/config"
     force: true
     remote_src: false
diff --git a/templates/ssh/config.j2 b/templates/ssh/config.j2
new file mode 100644
index 0000000..2a36916
--- /dev/null
+++ b/templates/ssh/config.j2
@@ -0,0 +1,52 @@
+#   $OpenBSD: ssh_config,v 1.34 2019/02/04 02:39:42 dtucker Exp $
+
+# This is the ssh client system-wide configuration file.  See
+# ssh_config(5) for more information.  This file provides defaults for
+# users, and the values can be changed in per-user configuration files
+# or on the command line.
+
+# Configuration data is parsed as follows:
+#  1. command line options
+#  2. user-specific file
+#  3. system-wide file
+# Any configuration value is only changed the first time it is set.
+# Thus, host-specific definitions should be at the beginning of the
+# configuration file, and defaults at the end.
+
+# Site-wide defaults for some commonly used options.  For a comprehensive
+# list of available options, their meanings and defaults, please see the
+# ssh_config(5) man page.
+
+ Host *
+    AddKeysToAgent yes
+   ForwardAgent yes
+#   ForwardX11 no
+#   PasswordAuthentication yes
+#   HostbasedAuthentication no
+#   GSSAPIAuthentication no
+#   GSSAPIDelegateCredentials no
+#   BatchMode no
+#   CheckHostIP yes
+#   AddressFamily any
+#   ConnectTimeout 0
+#   StrictHostKeyChecking ask
+#   IdentityFile ~/.ssh/id_rsa
+#   IdentityFile ~/.ssh/id_dsa
+#   IdentityFile ~/.ssh/id_ecdsa
+#   IdentityFile ~/.ssh/id_ed25519
+#   Port 22
+#   Ciphers aes128-ctr,aes192-ctr,aes256-ctr,aes128-cbc,3des-cbc
+#   MACs hmac-md5,hmac-sha1,umac-64@openssh.com
+#   EscapeChar ~
+#   Tunnel no
+#   TunnelDevice any:any
+#   PermitLocalCommand no
+#   VisualHostKey no
+#   ProxyCommand ssh -q -W %h:%p gateway.example.com
+#   RekeyLimit 1G 1h
+{% for host in system_ssh_custom_host %}
+Host {{ host.host }}
+   Hostname {{ host.host }}
+   User {{ host.user }}
+   IdentityFile {{ host.keyfile }}
+{% endfor %}