populate flake: add fetchOnTarget

With fetchOnTarget, the target fetches the input and its own inputs itself,
using fetchTree with the arguments recorded in the flake's lock file.  Only
nix flake metadata runs on the deploying machine, so the inputs get
downloaded once, by the target.  This needs Nix with flake support on the
target, which populate checks before fetching.

Because nothing gets copied, this also works for targets using sudo.

1 files changed, 13 insertions, 5 deletions

diff --git a/README.md b/README.md
index 84b1671..b6e3401 100644
--- a/README.md
+++ b/README.md
@@ -292,13 +292,21 @@ Supported attributes:
   which includes only files tracked by Git.  Use a `file` source for work
   trees with untracked files.
 
+* `fetchOnTarget` (optional) -
+  boolean that controls whether the target fetches the input itself instead
+  of receiving it from the deploying machine.  The target then uses the
+  arguments recorded in the lock file, so inputs that refer to local paths of
+  the deploying machine can't be fetched this way.  This requires `input`,
+  and Nix with flake support (Nix 2.4 or later) on the target.  Defaults to
+  `false`.
+
 Instead of an attribute set, the flake reference can be given as a string.
 
-The flake commands run using krops' own Nix, so flakes don't need to be
-enabled on the deploying machine.  The target only needs `nix-store`.
-Because the copied store paths aren't signed, the target user must be allowed
-to import them, i.e. be `root` or a trusted user.  Targets using `sudo` aren't
-supported.
+The flake commands on the deploying machine run using krops' own Nix, so
+flakes don't need to be enabled there.  Without `fetchOnTarget`, the target
+only needs `nix-store`.  Because the copied store paths aren't signed, the
+target user must be allowed to import them, i.e. be `root` or a trusted user,
+and targets using `sudo` aren't supported.
 
 Example: