tree imports all now

tree/deploy.nix

@@ -0,0 +1,84 @@
+{...}: {
+  flake.nixosModules.deploy = {
+    config,
+    pkgs,
+    lib,
+    ...
+  }:
+    with lib; let
+      cfg = config.c.services.remote-deploy;
+    in {
+      options.c.services.remote-deploy = {
+        enable = mkEnableOption "Enable remote deployment with nixinate.";
+        host = mkOption {
+          type = types.str;
+          description = "Hostname to connect to.";
+        };
+        user = mkOption {
+          type = types.str;
+          default = "deploy";
+          description = "Username for deploy account.";
+        };
+        group = mkOption {
+          type = types.str;
+          default = "deploy";
+          description = "Group for deploy account.";
+        };
+        keys = mkOption {
+          type = types.listOf types.str;
+          description = "Authorised SSH keys for deployment";
+        };
+        port = mkOption {
+          type = types.port;
+          default = 22;
+          description = "SSH port to use.";
+        };
+        buildOn = mkOption {
+          type = types.enum [
+            "local"
+            "remote"
+          ];
+          default = "local";
+          description = "Where to build the config.";
+        };
+        substituteOnTarget = mkOption {
+          type = types.bool;
+          default = true;
+          description = "Substitute closures and paths from remote";
+        };
+      };
+      config = mkIf cfg.enable {
+        _module.args = {
+          nixinate = {
+            inherit
+              (cfg)
+              host
+              buildOn
+              port
+              substituteOnTarget
+              ;
+            sshUser = cfg.user;
+          };
+        };
+        users.groups."${cfg.group}" = {};
+        users.users."${cfg.user}" = {
+          isSystemUser = true;
+          shell = pkgs.bash;
+          inherit (cfg) group;
+          openssh.authorizedKeys.keys = cfg.keys;
+        };
+        nix.settings.trusted-users = [cfg.user];
+        security.sudo.extraRules = [
+          {
+            groups = [cfg.group];
+            commands = [
+              {
+                command = "ALL";
+                options = ["NOPASSWD"];
+              }
+            ];
+          }
+        ];
+      };
+    };
+}