building without tf state

modules/meta/tailscale.nix

@@ -1,6 +1,7 @@
-{ config, pkgs, lib, root, ... }: with lib; let
+{ config, pkgs, lib, tree, ... }: with lib; let
   home = config.deploy.targets.home.tf;
 in {
+  imports = lib.optional (tree.pure.trusted ? modules.meta) tree.pure.trusted.modules.meta.tailscale;
   options = {
     tailnet_uri = mkOption {
       type = types.str;

nixos/systems/tewi/nixos.nix

@@ -15,7 +15,7 @@
     ./postgres.nix
     ./nginx.nix
     ../../gui/nfs.nix
-  ];
+  ] ++ lib.optional (meta.trusted ? nixos.systems.tewi.default) meta.trusted.nixos.systems.tewi.default;
 
   services.cockroachdb.locality = "provider=local,network=gensokyo,host=${config.networking.hostName}";
 

system/root.nix

@@ -1,3 +1,5 @@
-{ config, ... }: {
+{ config, meta, lib, ... }: {
+  imports = lib.optional (meta.trusted ? modules.nixos) meta.trusted.modules.nixos.deploy;
+
   home-manager.users.root.home.stateVersion = "20.09";
 }

trusted/flake.lock

@@ -610,18 +610,18 @@
     "trusted": {
       "flake": false,
       "locked": {
-        "lastModified": 1664745519,
-        "narHash": "sha256-tUNmmEjJ6KOOPkHCkJytv4KemXf4idM8erPQgOr7SWc=",
-        "ref": "main",
-        "rev": "f89074f4500dddb1962d49f3f542ce41d7beee87",
-        "revCount": 93,
+        "lastModified": 1671330960,
+        "narHash": "sha256-r8yqTEoOhZmTNlpThApRrZOAwc7+xrBBIXEk6nyx1pc=",
+        "ref": "shim",
+        "rev": "7848692e19091222d1fcafa51ffd48ceeb037ab6",
+        "revCount": 1,
         "type": "git",
-        "url": "ssh://git@github.com/kittywitch/nixfiles-trusted"
+        "url": "gcrypt::ssh://git@github.com/arcnmx/kat-nixfiles-trusted.git"
       },
       "original": {
-        "ref": "main",
+        "ref": "shim",
         "type": "git",
-        "url": "ssh://git@github.com/kittywitch/nixfiles-trusted"
+        "url": "gcrypt::ssh://git@github.com/arcnmx/kat-nixfiles-trusted.git"
       }
     },
     "ts-fold": {

trusted/flake.nix

@@ -1,7 +1,9 @@
 {
   inputs = {
     trusted = {
-      url = "git+ssh://git@github.com/kittywitch/nixfiles-trusted?ref=main";
+      type = "git";
+      url = "gcrypt::ssh://git@github.com/arcnmx/kat-nixfiles-trusted.git";
+      ref = "shim";
       flake = false;
     };
     nixfiles = {