README.md

@@ -6,7 +6,6 @@ krops is a lightweight toolkit to deploy NixOS systems, remotely or locally.
 ## Some Features
 
 - store your secrets in [password store](https://www.passwordstore.org/)
-                     or [passage](https://github.com/FiloSottile/passage)
 - build your systems remotely
 - minimal overhead (it's basically just `nixos-rebuild switch`!)
 - run from custom nixpkgs branch/checkout/fork
@@ -97,7 +96,7 @@ pkgs.krops.writeDeploy "deploy" {
 }
 ```
 For more details about the `target` attribute, please check the `mkTarget`
-function in [lib/default.nix](lib/default.nix).
+function in [lib/default.nix](lib/defaults.nix).
 
 ### `backup` (optional, defaults to false)
 
@@ -137,29 +136,6 @@ Create the sentinel file (`/var/src/.populate`) before syncing the new source.
 
 Specifies which `nixos-rebuild` operation to perform.
 
-### `useNixOutputMonitor` (optional, defaults to `"opportunistic"`)
-
-Specifies when to pipe `nixos-rebuild`'s output to
-[nom](https://github.com/maralorn/nix-output-monitor).
-
-Supported values:
-
-* `"opportunistic"` (default) -
-  Use `nom` only if it is present on the target machine.
-
-* `"optimistic"` -
-  Use `nom`, assuming it is present on the target machine.
-
-* `"pessimistic"` -
-  Use `nom` via `nix-shell` on the target machine.
-
-* `true` -
-  Use `nom`.
-  If it is not present on the target machine, then use it via `nix-shell`.
-
-* `false` -
-  Don't use `nom`
-
 ## writeTest
 
 Very similiar to writeDeploy, but just builds the system on the target without
@@ -299,29 +275,6 @@ Supported attributes:
   sub-directory in the password store.
 
 
-### `passage`
-
-The passage source type decrypts files from a local
-[passage store](https://github.com/FiloSottile/passage)
-and transfers them to the target using
-[`rsync`](https://rsync.samba.org/).
-
-Supported attributes:
-
-* `dir` -
-  Path to the passage store.
-  For a partial transfer, this may point to a subdirectory.
-  Example: `~/.passage/store/hosts/MYHOSTNAME`
-
-* `identities_file` (optional) -
-  Path to the identities file.
-  Defaults to `~/.passage/identities`.
-
-* `age` (optional) -
-  Path of the age binary.
-  Defaults to `age` (absolute path gets resolved using `passage`'s search path.)
-
-
 ### `pipe`
 
 Executes a local command, capture its stdout, and send that as a file to the

flake.lock

@@ -1,27 +0,0 @@
-{
-  "nodes": {
-    "nixpkgs": {
-      "locked": {
-        "lastModified": 1689940971,
-        "narHash": "sha256-397xShPnFqPC59Bmpo3lS+/Aw0yoDRMACGo1+h2VJMo=",
-        "owner": "NixOS",
-        "repo": "nixpkgs",
-        "rev": "9ca785644d067445a4aa749902b29ccef61f7476",
-        "type": "github"
-      },
-      "original": {
-        "owner": "NixOS",
-        "ref": "nixos-unstable",
-        "repo": "nixpkgs",
-        "type": "github"
-      }
-    },
-    "root": {
-      "inputs": {
-        "nixpkgs": "nixpkgs"
-      }
-    }
-  },
-  "root": "root",
-  "version": 7
-}

flake.nix

@@ -1,29 +0,0 @@
-{
-  description = "krops - krebs operations";
-
-  inputs = {
-    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
-  };
-
-  outputs = { self, nixpkgs, ... }:
-    let
-      supportedSystems = [
-        "x86_64-linux"
-        "i686-linux"
-        "aarch64-linux"
-        "riscv64-linux"
-      ];
-      forAllSystems = nixpkgs.lib.genAttrs supportedSystems;
-    in
-    {
-      lib = forAllSystems (system:
-        let
-          pkgs = nixpkgs.legacyPackages.${system};
-          krops = pkgs.callPackage ./pkgs/krops {};
-          populate = pkgs.callPackage ./pkgs/populate {};
-        in {
-          inherit populate;
-          inherit (krops) rebuild runShell withNixOutputMonitor writeCommand writeDeploy writeTest;
-        });
-    };
-}

lib/types/populate.nix

@@ -39,17 +39,6 @@
         default = null;
         type = lib.types.nullOr source-types.pass;
       };
-      passage = lib.mkOption {
-        apply = x:
-          if lib.types.pathname.check x
-            then { dir = x; }
-            else x;
-        default = null;
-        type = lib.types.nullOr (lib.types.oneOf [
-          lib.types.pathname
-          source-types.passage
-        ]);
-      };
       pipe = lib.mkOption {
         apply = x:
           if lib.types.absolute-pathname.check x
@@ -171,21 +160,6 @@
         };
       };
     };
-    passage = lib.types.submodule {
-      options = {
-        age = lib.mkOption {
-          default = "age";
-          type = lib.types.pathname;
-        };
-        dir = lib.mkOption {
-          type = lib.types.pathname;
-        };
-        identities_file = lib.mkOption {
-          default = toString ~/.passage/identities;
-          type = lib.types.pathname;
-        };
-      };
-    };
     pipe = lib.types.submodule {
       options = {
         command = lib.mkOption {

pkgs/krops/default.nix

@@ -4,24 +4,16 @@ in
 
 { nix, openssh, populate, writers }: rec {
 
-  rebuild = {
+  rebuild = args: target:
-    useNixOutputMonitor
+    runShell target {} "nixos-rebuild -I ${lib.escapeShellArg target.path} ${
-  }:
+      lib.concatMapStringsSep " " lib.escapeShellArg args
-  args: target:
+    }";
-    runShell target {}
-      (withNixOutputMonitor target useNixOutputMonitor /* sh */ ''
-        NIX_PATH=${lib.escapeShellArg target.path} \
-        nixos-rebuild ${lib.escapeShellArgs args}
-      '');
 
   runShell = target: {
     allocateTTY ? false
   }: command:
     let
-      command' = /* sh */ ''
+      command' = if target.sudo then "sudo ${command}" else command;
-        ${lib.optionalString target.sudo "sudo"} \
-        /bin/sh -c ${lib.escapeShellArg command}
-      '';
     in
       if lib.isLocalTarget target
       then command'
@@ -32,42 +24,7 @@ in
             (if allocateTTY then "-t" else "-T")
             target.extraOptions
             target.host
-            command'
+            command'])}
-          ])}
-        '';
-
-  withNixOutputMonitor = target: mode_: command: let
-    mode =
-      lib.getAttr (lib.typeOf mode_)  {
-        bool = lib.toJSON mode_;
-        string = mode_;
-      };
-  in /* sh */ ''
-    printf '# use nix-output-monitor: %s\n' ${lib.escapeShellArg mode} >&2
-    ${lib.getAttr mode rec {
-      opportunistic = /* sh */ ''
-        if command -v nom >/dev/null; then
-          ${optimistic}
-        else
-          ${false}
-        fi
-      '';
-      optimistic = /* sh */ ''
-        (${command}) 2>&1 | nom
-      '';
-      pessimistic = /* sh */ ''
-        NIX_PATH=${lib.escapeShellArg target.path} \
-        nix-shell -p nix-output-monitor --run ${lib.escapeShellArg optimistic}
-      '';
-      true = /* sh */ ''
-        if command -v nom >/dev/null; then
-          ${optimistic}
-        else
-          ${pessimistic}
-        fi
-      '';
-      false = command;
-    }}
         '';
 
   writeCommand = name: {
@@ -94,8 +51,7 @@ in
     force ? false,
     operation ? "switch",
     source,
-    target,
+    target
-    useNixOutputMonitor ? "opportunistic"
   }: let
     buildTarget' =
       if buildTarget == null
@@ -109,7 +65,7 @@ in
         ${lib.optionalString (buildTarget' != target')
           (populate { inherit backup force source; target = buildTarget'; })}
         ${populate { inherit backup force source; target = target'; }}
-        ${rebuild { inherit useNixOutputMonitor; } ([
+        ${rebuild ([
           operation
         ] ++ lib.optionals crossDeploy [
           "--no-build-nix"

pkgs/populate/default.nix

@@ -1,7 +1,7 @@
 with import ../../lib;
 with shell;
 
-{ coreutils, dash, findutils, git, jq, openssh, pass, passage, rsync, writers }:
+{ coreutils, dash, findutils, git, jq, openssh, pass, rsync, writers }:
 
 let
   check = { force, target }: let
@@ -119,15 +119,7 @@ let
     umask 0077
 
     if test -e ${quote source.dir}/.git; then
-      local_pass_info=${quote source.name}\ $(
+      local_pass_info=${quote source.name}\ $(${git}/bin/git -C ${quote source.dir} log -1 --format=%H ${quote source.name})
-        ${git}/bin/git -C ${quote source.dir} log -1 --format=%H ${quote source.name}
-        # we append a hash for every symlink, otherwise we would miss updates on
-        # files where the symlink points to
-        ${findutils}/bin/find ${quote source.dir}/${quote source.name} -type l \
-            -exec ${coreutils}/bin/realpath {} + |
-          ${coreutils}/bin/sort |
-          ${findutils}/bin/xargs -r -n 1 ${git}/bin/git -C ${quote source.dir} log -1 --format=%H
-      )
       remote_pass_info=$(${runShell target /* sh */ ''
         cat ${quote target.path}/.pass_info || :
       ''})
@@ -171,37 +163,6 @@ let
     ${rsync' target rsyncDefaultConfig /* sh */ "$tmp_dir"}
   '';
 
-  pop.passage = target: source: /* sh */ ''
-    set -efu
-
-    export PASSAGE_AGE=${quote source.age}
-    export PASSAGE_DIR=${quote source.dir}
-    export PASSAGE_IDENTITIES_FILE=${quote source.identities_file}
-
-    umask 0077
-
-    tmp_dir=$(${coreutils}/bin/mktemp -dt populate-passage.XXXXXXXX)
-    trap cleanup EXIT
-    cleanup() {
-      rm -fR "$tmp_dir"
-    }
-
-    ${findutils}/bin/find "$PASSAGE_DIR" -type f -name \*.age -follow |
-    while read -r age_path; do
-
-      rel_name=''${age_path#$PASSAGE_DIR}
-      rel_name=''${rel_name%.age}
-
-      tmp_path=$tmp_dir/$rel_name
-
-      ${coreutils}/bin/mkdir -p "$(${coreutils}/bin/dirname "$tmp_path")"
-      ${passage}/bin/passage show "$rel_name" > "$tmp_path"
-      ${coreutils}/bin/touch -r "$age_path" "$tmp_path"
-    done
-
-    ${rsync' target rsyncDefaultConfig /* sh */ "$tmp_dir"}
-  '';
-
   pop.pipe = target: source: /* sh */ ''
     ${quote source.command} | {
       ${runShell target /* sh */ "cat > ${quote target.path}"}