I extracted this block to a method called get_ssh_gateway_for, and added some comments to the new method to clarify which config takes precedence