From 962a0ed7337e5f83dfe9ad0933fae05ad2471aeb Mon Sep 17 00:00:00 2001
From: tv <tv@krebsco.de>
Date: Wed, 11 Nov 2026 20:13:30 +0000
Subject: populate flake: support fetchOnTarget

With fetchOnTarget, the target fetches the flake's inputs using the
arguments recorded in the lock file, like it does for flake-input
sources.  The flake itself has no lock entry, so the target fetches it
by its locked reference, unless that refers to the deploying machine,
e.g. a path or a Git work tree.  Then the flake's tree gets transferred
using rsync and added to the target's store using nix-store --add-fixed,
which yields the same store path as on the deploying machine, because
flake store paths are content-addressed by their NAR hash.  Adding paths
like this needs neither signatures nor a trusted user, so this works for
targets using sudo.  The transfer gets skipped if the target's store has
the flake already, and populate fails if the added path differs from
the expected one.

rsync' gets a filterFiles option, so the flake's tree gets transferred
without applying .rsync-filter files, which would change it.
---
 lib/types/populate.nix | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'lib')

diff --git a/lib/types/populate.nix b/lib/types/populate.nix
index e971fd8..51e5430 100644
--- a/lib/types/populate.nix
+++ b/lib/types/populate.nix
@@ -170,6 +170,10 @@
     };
     flake = lib.types.submodule {
       options = {
+        fetchOnTarget = lib.mkOption {
+          default = false;
+          type = lib.types.bool;
+        };
         flake = lib.mkOption {
           type = lib.types.str; # TODO lib.types.flake-ref
         };
-- 
cgit v1.3.1