From da724b351161cb5c7e094402172c22c4bc5b82ec Mon Sep 17 00:00:00 2001
From: Kiara Grouwstra <kiara@procolix.eu>
Date: Fri, 7 Nov 2025 13:47:46 +0100
Subject: [PATCH] allow use of `readOnly` attributes in modular function output
 types

Signed-off-by: Kiara Grouwstra <kiara@procolix.eu>
---
 deployment/data-model.nix    |  2 ++
 deployment/function-test.nix | 44 ++++++++++++++++++++++++++++++++++++
 deployment/function.nix      |  9 ++++++--
 deployment/run/default.nix   | 14 +++++-------
 4 files changed, 59 insertions(+), 10 deletions(-)

diff --git a/deployment/data-model.nix b/deployment/data-model.nix
index ae400985..5c518483 100644
--- a/deployment/data-model.nix
+++ b/deployment/data-model.nix
@@ -140,6 +140,7 @@ in
               type = functionType;
               readOnly = true;
               default = {
+                type-output = false;
                 input-type = submodule {
                   options = {
                     deployment-name = mkOption {
@@ -159,6 +160,7 @@ in
               type = functionType;
               readOnly = true;
               default = {
+                type-output = false;
                 input-type = submodule {
                   options = {
                     deployment-name = mkOption {
diff --git a/deployment/function-test.nix b/deployment/function-test.nix
index 73f306ce..98172b36 100644
--- a/deployment/function-test.nix
+++ b/deployment/function-test.nix
@@ -105,4 +105,48 @@ in
       value = false;
     };
   };
+
+  test-read-only = {
+    expr =
+      tryEval
+        (lib.evalModules {
+          modules = [
+            (
+              { config, ... }:
+              {
+                options = {
+                  fn = mkOption {
+                    type = functionType;
+                  };
+                  call = mkOption {
+                    default = config.fn.apply { };
+                  };
+                };
+                config.fn =
+                  let
+                    sub = submodule {
+                      options.foo = mkOption {
+                        type = int;
+                        readOnly = true;
+                        default = 1;
+                      };
+                    };
+                  in
+                  {
+                    implementation = x: x;
+                    input-type = sub;
+                    output-type = sub;
+                    type-output = false;
+                  };
+              }
+            )
+          ];
+        }).config.call;
+    expected = {
+      success = true;
+      value = {
+        foo = 1;
+      };
+    };
+  };
 }
diff --git a/deployment/function.nix b/deployment/function.nix
index 63533fdc..b08b2ace 100644
--- a/deployment/function.nix
+++ b/deployment/function.nix
@@ -45,6 +45,11 @@ let
 in
 {
   options = {
+    type-output = mkOption {
+      type = types.bool;
+      description = "Whether to type function output. This may need to be disabled if the output type contains read-only attributes.";
+      default = true;
+    };
     input-type = mkOption {
       type = optionType;
     };
@@ -54,7 +59,7 @@ in
     function-type = mkOption {
       type = optionType;
       readOnly = true;
-      default = functionTo config.output-type;
+      default = functionTo (if config.type-output then config.output-type else types.unspecified);
     };
     wrapper-type = mkOption {
       type = optionType;
@@ -65,7 +70,7 @@ in
             type = config.input-type;
           };
           output = mkOption {
-            type = config.output-type;
+            type = if config.type-output then config.output-type else types.unspecified;
           };
         };
       });
diff --git a/deployment/run/default.nix b/deployment/run/default.nix
index 92801079..53a9e9f2 100644
--- a/deployment/run/default.nix
+++ b/deployment/run/default.nix
@@ -202,8 +202,7 @@ in
         };
         run = mkOption {
           type = types.package;
-          # error: The option `ssh-deployment.ssh-host.run' is read-only, but it's set multiple times.
-          # readOnly = true;
+          readOnly = true;
           default =
             let
               inherit (ssh-host.config)
@@ -282,8 +281,7 @@ in
         };
         run = mkOption {
           type = types.package;
-          # error: The option `tf-deployment.tf-host.run' is read-only, but it's set multiple times.
-          # readOnly = true;
+          readOnly = true;
           default =
             let
               inherit (tf-host.config)
@@ -354,8 +352,7 @@ in
         };
         run = mkOption {
           type = types.package;
-          # error: The option `tf-deployment.tf-host.run' is read-only, but it's set multiple times.
-          # readOnly = true;
+          readOnly = true;
           default =
             let
               inherit (tf-host.config)
@@ -499,8 +496,7 @@ in
         };
         run = mkOption {
           type = types.package;
-          # error: The option `tf-deployment.tf-host.run' is read-only, but it's set multiple times.
-          # readOnly = true;
+          readOnly = true;
           default =
             let
               inherit (tf-host.config)
@@ -587,6 +583,7 @@ in
         };
         run = mkOption {
           type = types.package;
+          readOnly = true;
           default =
             let
               inherit (tf-netbox-store-ips.config)
@@ -614,6 +611,7 @@ in
         inherit httpBackend;
         run = mkOption {
           type = types.package;
+          readOnly = true;
           default =
             let
               inherit (tf-netbox-get-ip.config)