populate flake: support fetchOnTarget

With fetchOnTarget, the target fetches the flake's inputs using the
arguments recorded in the lock file, like it does for flake-input
sources.  The flake itself has no lock entry, so the target fetches it
by its locked reference, unless that refers to the deploying machine,
e.g. a path or a Git work tree.  Then the flake's tree gets transferred
using rsync and added to the target's store using nix-store --add-fixed,
which yields the same store path as on the deploying machine, because
flake store paths are content-addressed by their NAR hash.  Adding paths
like this needs neither signatures nor a trusted user, so this works for
targets using sudo.  The transfer gets skipped if the target's store has
the flake already, and populate fails if the added path differs from
the expected one.

rsync' gets a filterFiles option, so the flake's tree gets transferred
without applying .rsync-filter files, which would change it.

1 files changed, 4 insertions, 0 deletions

diff --git a/lib/types/populate.nix b/lib/types/populate.nix
index e971fd8..51e5430 100644
--- a/lib/types/populate.nix
+++ b/lib/types/populate.nix
@@ -170,6 +170,10 @@
     };
     flake = lib.types.submodule {
       options = {
+        fetchOnTarget = lib.mkOption {
+          default = false;
+          type = lib.types.bool;
+        };
         flake = lib.mkOption {
           type = lib.types.str; # TODO lib.types.flake-ref
         };