old-school config handling requires manipulating one file,
e.g. /etc/ssh/ssh_config.
when doing configuration management, then that is very unfortunate
design (thus unrelated of the implementation of the configuration
management, be it homegrown or any of ansible/puppet/chef/$whatever...),
because the file has to be parsed and edited - which inevitably always
leads to problems over time, no matter how "good" the parser for a
specific conffile is (be it comments added, local changes, or just the
fact that the package management (dpkg/rpm) treat it as "modified" and
thus will prompt for it on upgrades).
the way to fix this completely is to allow to drop "snippets" of config
files into a directory, which then are read lexicographically sorted.