diff --git a/setup.sh b/setup.sh
index 66960f8..c7b3b84 100755
--- a/setup.sh
+++ b/setup.sh
@@ -17,7 +17,9 @@ SRC_DIR="$DIR/src"
 copy_files=()
 files_to_remove=()
 while IFS=  read -r -d $'\0'; do
-	copy_files+=( "$(basename "$REPLY")" )
+	# remove leading $SRC_DIR/ from found files
+	# this allows directories to be preserved
+	copy_files+=( "${REPLY//$SRC_DIR\//}" )
 done < <(find "$SRC_DIR" -type f -print0)
 
 if [ $remove -eq 1 ]; then
@@ -49,6 +51,9 @@ elif [ $remove -eq 0 ]; then
 		if [[ -h "$target" ]] && [[ "$source" == "$(readlink -f "$target")" ]]; then
 			echo "Skipping '${source}' -> '${target}' link as it is already linked"
 		else
+			# NOTE: This applies 0700 permissions only to the deepest directory
+			# shellcheck disable=SC2174
+			mkdir -m 0700 -p "$(dirname "$target")"
 			ln -sv "$source" "$target"
 		fi
 	done
@@ -56,3 +61,6 @@ fi
 
 # install vscode configs
 source vscode.sh
+
+# set up SSH config and create key if needed
+source ssh.sh
diff --git a/src/.ssh/config b/src/.ssh/config
new file mode 100644
index 0000000..0a75c36
--- /dev/null
+++ b/src/.ssh/config
@@ -0,0 +1,26 @@
+Host *
+	# Specifies whether keys should be automatically added to a running
+	# ssh-agent(1). If this option is set to yes and a key is loaded from a file,
+	# the key and its passphrase are added to the agent with the default lifetime,
+	# as if by ssh-add(1).
+	AddKeysToAgent yes
+
+	# Requests compression of all data
+	Compression yes
+
+	# Sets a timeout interval in seconds after which if no data has been received
+	# from the server, ssh(1) will send a message through the encrypted channel to
+	# request a response from the server. The default is 0, indicating that these
+	# messages will not be sent to the server.
+	ServerAliveInterval 300
+
+	# Reuse SSH connection to speed up remote login process using multiplexing.
+	ControlPath /tmp/ssh-control-%C
+	ControlPersist 5s
+	ControlMaster auto
+
+# Load user scripts and functions if existing. Order is important.
+#
+# Troubleshooting:
+#   ssh -vT git@github.com
+Include config.d/*
diff --git a/ssh.sh b/ssh.sh
new file mode 100644
index 0000000..f249f40
--- /dev/null
+++ b/ssh.sh
@@ -0,0 +1,12 @@
+#!/usr/bin/env bash
+set -e
+
+# set 0600 permissions on config file
+# (setting permissions on a symlink does nothing; see chmod(1))
+chmod 0600 "$( dirname "$(readlink -f "${BASH_SOURCE[0]}")" )/src/.ssh/config"
+
+# prompt to create key if none exists
+if [[ "$(find ~/.ssh -maxdepth 1 -type f -name '*.pub' | wc -l)" == 0 ]]; then
+	echo 'No SSH keys found; creating one now.'
+	ssh-keygen -t ed25519 -C 'nightfirecat@nightfirec.at'
+fi