From 4f50602ee86b644eaec072d1bdf1b40e45faa832 Mon Sep 17 00:00:00 2001
From: Kiara Grouwstra <kiara@procolix.eu>
Date: Fri, 7 Nov 2025 13:47:46 +0100
Subject: [PATCH] allow use of `readOnly` attributes in modular function output
 types

Signed-off-by: Kiara Grouwstra <kiara@procolix.eu>
---
 deployment/data-model.nix  |  2 ++
 deployment/function.nix    |  9 +++++++--
 deployment/run/default.nix | 14 ++++++--------
 3 files changed, 15 insertions(+), 10 deletions(-)

diff --git a/deployment/data-model.nix b/deployment/data-model.nix
index ae400985..5c518483 100644
--- a/deployment/data-model.nix
+++ b/deployment/data-model.nix
@@ -140,6 +140,7 @@ in
               type = functionType;
               readOnly = true;
               default = {
+                type-output = false;
                 input-type = submodule {
                   options = {
                     deployment-name = mkOption {
@@ -159,6 +160,7 @@ in
               type = functionType;
               readOnly = true;
               default = {
+                type-output = false;
                 input-type = submodule {
                   options = {
                     deployment-name = mkOption {
diff --git a/deployment/function.nix b/deployment/function.nix
index 63533fdc..b08b2ace 100644
--- a/deployment/function.nix
+++ b/deployment/function.nix
@@ -45,6 +45,11 @@ let
 in
 {
   options = {
+    type-output = mkOption {
+      type = types.bool;
+      description = "Whether to type function output. This may need to be disabled if the output type contains read-only attributes.";
+      default = true;
+    };
     input-type = mkOption {
       type = optionType;
     };
@@ -54,7 +59,7 @@ in
     function-type = mkOption {
       type = optionType;
       readOnly = true;
-      default = functionTo config.output-type;
+      default = functionTo (if config.type-output then config.output-type else types.unspecified);
     };
     wrapper-type = mkOption {
       type = optionType;
@@ -65,7 +70,7 @@ in
             type = config.input-type;
           };
           output = mkOption {
-            type = config.output-type;
+            type = if config.type-output then config.output-type else types.unspecified;
           };
         };
       });
diff --git a/deployment/run/default.nix b/deployment/run/default.nix
index 92801079..53a9e9f2 100644
--- a/deployment/run/default.nix
+++ b/deployment/run/default.nix
@@ -202,8 +202,7 @@ in
         };
         run = mkOption {
           type = types.package;
-          # error: The option `ssh-deployment.ssh-host.run' is read-only, but it's set multiple times.
-          # readOnly = true;
+          readOnly = true;
           default =
             let
               inherit (ssh-host.config)
@@ -282,8 +281,7 @@ in
         };
         run = mkOption {
           type = types.package;
-          # error: The option `tf-deployment.tf-host.run' is read-only, but it's set multiple times.
-          # readOnly = true;
+          readOnly = true;
           default =
             let
               inherit (tf-host.config)
@@ -354,8 +352,7 @@ in
         };
         run = mkOption {
           type = types.package;
-          # error: The option `tf-deployment.tf-host.run' is read-only, but it's set multiple times.
-          # readOnly = true;
+          readOnly = true;
           default =
             let
               inherit (tf-host.config)
@@ -499,8 +496,7 @@ in
         };
         run = mkOption {
           type = types.package;
-          # error: The option `tf-deployment.tf-host.run' is read-only, but it's set multiple times.
-          # readOnly = true;
+          readOnly = true;
           default =
             let
               inherit (tf-host.config)
@@ -587,6 +583,7 @@ in
         };
         run = mkOption {
           type = types.package;
+          readOnly = true;
           default =
             let
               inherit (tf-netbox-store-ips.config)
@@ -614,6 +611,7 @@ in
         inherit httpBackend;
         run = mkOption {
           type = types.package;
+          readOnly = true;
           default =
             let
               inherit (tf-netbox-get-ip.config)