fix typos, lint, format

turns out we also need a collection of configurations, obviously
next: figure out where to wire everything up to obtain a deployment

default.nix

@@ -9,6 +9,8 @@ let
     git-hooks
     gitignore
     ;
+  inherit (import sources.flake-inputs) import-flake;
+  inputs = (import-flake { src = ./.; }).inputs;
   inherit (pkgs) lib;
   pre-commit-check =
     (import "${git-hooks}/nix" {
@@ -67,6 +69,7 @@ in
   # re-export inputs so they can be overridden granularly
   # (they can't be accessed from the outside any other way)
   inherit
+    inputs
     sources
     system
     pkgs

deployment/data-model-test.nix

@@ -1,67 +1,170 @@
 let
-  inherit (import ../default.nix { }) pkgs;
+  inherit (import ../default.nix { }) pkgs inputs;
   inherit (pkgs) lib;
+  inherit (lib) mkOption types;
   eval =
     module:
     (lib.evalModules {
+      specialArgs = {
+        inherit inputs;
+      };
       modules = [
         module
         ./data-model.nix
       ];
     }).config;
+  nixops4Deployment = inputs.nixops4.modules.nixops4Deployment.default;
 in
 {
-  _class = "nix-unit";
-
   test-eval = {
     expr =
       let
-        example = eval (
+        fediversity = eval (
           { config, ... }:
           {
-            providers.single-ssh-host =
+            config = {
+              resources.nixos-configuration = {
+                description = "An entire NixOS configuration";
+                request =
                   { ... }:
                   {
-                system.stateVersion = "25.05";
+                    _class = "fediversity-resource-request";
-              };
+                    options.config = mkOption {
-            resources.bar.runtime-environment.single-ssh-host = {
+                      description = "Any options from NixOS";
-              ssh = {
-                host = "localhost";
-                username = "root";
-                authentication.password = "";
                     };
                   };
-            applications.foo.module =
+
-              { pkgs, ... }:
+                policy =
+                  { config, ... }:
                   {
-                environment.systemPackages = [
+                    _class = "fediversity-resource-policy";
-                  pkgs.hello
+
+                    options = {
+                      extra-config = mkOption {
+                        description = "Any options from NixOS";
+                      };
+                      apply = mkOption {
+                        type = with types; functionTo raw;
+                        default = requests: lib.mkMerge (requests ++ [ config.extra-config ]);
+                      };
+                    };
+                  };
+              };
+              resources.login-shell = {
+                description = "The operator needs to be able to log into the shell";
+                request =
+                  { ... }:
+                  {
+                    _class = "fediversity-resource-request";
+                    options = {
+                      wheel = mkOption {
+                        description = "Whether the login user needs root permissions";
+                        type = types.bool;
+                        default = false;
+                      };
+                      packages = mkOption {
+                        description = "Packages that need to be available in the user environment";
+                        type = with types; attrsOf package;
+                      };
+                    };
+                  };
+                policy =
+                  { config, ... }:
+                  {
+                    _class = "fediversity-resource-policy";
+                    options = {
+                      username = mkOption {
+                        description = "Username for the operator";
+                        type = types.str; # TODO: use the proper constraints from NixOS
+                      };
+                      wheel = mkOption {
+                        description = "Whether to allow login with root permissions";
+                        type = types.bool;
+                        default = false;
+                      };
+                      apply = mkOption {
+                        type = with types; functionTo raw; # TODO: splice out the user type from NixOS
+                        default =
+                          requests:
+                          let
+                            # Filter out requests that need wheel if policy doesn't allow it
+                            validRequests = lib.filterAttrs (_name: req: !req.wheel || config.wheel) requests;
+                          in
+                          lib.optionalAttrs (validRequests != { }) {
+                            ${config.username} = {
+                              isNormalUser = true;
+                              packages = with lib; concatMapAttrs (_name: request: attrValues request.packages) validRequests;
+                              extraGroups = lib.optional config.wheel "wheel";
+                            };
+                          };
+                      };
+                    };
+                  };
+              };
+              applications.hello =
+                { ... }:
+                {
+                  description = ''Command-line tool that will print "Hello, world!" on the terminal'';
+                  module =
+                    { ... }:
+                    {
+                      enable = lib.mkEnableOption "Hello in the shell";
+                    };
+                  implementation =
+                    cfg:
+                    lib.optionalAttrs cfg.enable {
+                      dummy.login-shell.packages.hello = pkgs.hello;
+                    };
+                };
+              environments.single-nixos-vm =
+                { config, ... }:
+                {
+                  resources.shell.login-shell.username = "operator";
+                  implementation =
+                    requests:
+                    { providers, ... }:
+                    {
+                      providers = {
+                        inherit (inputs.nixops4.modules.nixops4Provider) local;
+                      };
+                      resources.the-machine = {
+                        type = providers.local.exec;
+                        imports = [
+                          inputs.nixops4-nixos.modules.nixops4Resource.nixos
                         ];
+                        nixos.module =
+                          { ... }:
+                          {
+                            users.users = config.resources.shell.login-shell.apply (
+                              lib.filterAttrs (_name: value: value ? login-shell) requests
+                            );
                           };
-            deployments.baz = {
-              module = { };
-              runtime-environment = config.resources.bar.runtime-environment;
                       };
-            migrations.boo = {
+                    };
-              deployment = config.deployments.baz;
+                };
-              runtime-environment = config.resources.bar.runtime-environment;
+            };
+            options = {
+              example-configuration = mkOption {
+                type = config.configuration;
+                readOnly = true;
+                default = {
+                  enable = true;
+                  applications.hello.enable = true;
+                };
+              };
+              example-deployment = mkOption {
+                type = types.submodule nixops4Deployment;
+                readOnly = true;
+                default = config.environments.single-nixos-vm.deployment config.example-configuration;
+              };
             };
           }
         );
       in
       {
-        has-provider = lib.isAttrs example.providers.single-ssh-host;
+        inherit (fediversity) example-deployment;
-        has-resource = lib.isAttrs example.resources.bar.runtime-environment.single-ssh-host.module;
-        has-application = lib.isAttrs example.applications.foo.module;
-        has-deployment = lib.isAttrs example.deployments.baz.module;
-        has-migration = lib.isAttrs example.migrations.boo.deployment;
       };
     expected = {
-      has-provider = true;
-      has-resource = true;
-      has-application = true;
-      has-deployment = true;
-      has-migration = true;
     };
   };
 }

deployment/data-model.nix

@@ -1,179 +1,180 @@
 {
   lib,
   config,
+  inputs,
   ...
 }:
 let
-  inherit (lib)
+  inherit (lib) mkOption types;
-    attrNames
-    mapAttrs
-    mkOption
-    genAttrs
-    ;
   inherit (lib.types)
     attrsOf
     attrTag
-    deferredModule
+    deferredModuleWith
-    mergeTypes
-    nullOr
-    submoduleWith
     submodule
-    str
+    optionType
+    functionTo
     ;
-  provider = mkOption {
+
-    description = "The NixOS module of a provider";
+  functionType = import ./function.nix;
-    type = deferredModule;
+  application-resources = {
-    default = {
+    options.resources = mkOption {
-      _class = "nixos";
+      # TODO: maybe transpose, and group the resources by type instead
-    };
+      type = attrsOf (
-  };
+        attrTag (
-  runtime-environment = attrTag (
+          lib.mapAttrs' (name: resource: {
-    mapAttrs
+            ${name} = mkOption { type = resource.request; };
-      (
+          }) config.resources
-        name:
-        option@{ type, ... }:
-        mkOption (
-          option
-          // {
-            type = mergeTypes type (submodule {
-              options.module = mkOption {
-                description = "The NixOS module of the provider";
-                type = deferredModule;
-                default = config.providers.${name};
-                readOnly = true;
-              };
-            });
-          }
         )
-      )
-      {
-        vm = {
-          description = "A VM to deploy to.";
-          type = submodule {
-            options = {
-            };
-          };
-        };
-        single-ssh-host = {
-          description = "A single host to deploy to by SSH.";
-          type = submodule {
-            options = {
-              ssh = mkOption {
-                description = "SSH connection info";
-                type = submodule {
-                  options = {
-                    host = mkOption {
-                      description = "the host to access by SSH";
-                      type = str;
-                    };
-                    username = mkOption {
-                      description = "the SSH user to use";
-                      type = nullOr str;
-                      default = null;
-                    };
-                    authentication = mkOption {
-                      description = "authentication method";
-                      type = attrsOf (attrTag {
-                        private-key = mkOption {
-                          description = "path to the user's SSH private key";
-                          type = str;
-                          example = "/root/.ssh/id_ed25519";
-                        };
-                        password = mkOption {
-                          description = "SSH password";
-                          # TODO: mark as sensitive
-                          type = str;
-                        };
-                      });
-                    };
-                  };
-                };
-              };
-            };
-          };
-        };
-      }
       );
-  resource = attrTag {
-    runtime-environment = mkOption {
-      description = "A run-time environment one may deploy a NixOS configuration to.";
-      type = runtime-environment;
     };
   };
-  application = submoduleWith {
+  nixops4Deployment = inputs.nixops4.modules.nixops4Deployment.default;
-    description = "A Fediversity application";
-    modules = [
-      {
-        options = {
-          module = mkOption {
-            description = ''
-              The NixOS module to configure the application.
-            '';
-            type = deferredModule;
-          };
-        };
-      }
-    ];
-  };
-  deployment = submoduleWith {
-    description = "A deployment of a configuration of applications to a run-time environment";
-    modules = [
-      {
-        options = {
-          # the `applications` option consists of configuration for the above applications
-          module = mkOption {
-            description = ''
-              Configuration to be deployed
-            '';
-            type = deferredModule;
-          };
-          runtime-environment = mkOption {
-            description = "The run-time environment to deploy to";
-            type = runtime-environment;
-          };
-        };
-      }
-    ];
-  };
-  migration = submoduleWith {
-    description = "Migration of a Fediversity deployment to a Fediversity run-time environment";
-    modules = [
-      {
-        options = {
-          deployment = mkOption {
-            description = "Deployment to migrate";
-            type = deployment;
-          };
-          runtime-environment = mkOption {
-            description = "Run-time environment to migrate the deployment to";
-            type = runtime-environment;
-          };
-        };
-      }
-    ];
-  };
 in
 {
   options = {
-    providers = mkOption {
-      description = "Collection of providers for run-time environments to deploy applications to";
-      type = attrTag (genAttrs (attrNames runtime-environment.nestedTypes) (_: provider));
-    };
     resources = mkOption {
-      description = "Collection of resources for use in Fediversity applications";
+      description = "Collection of deployment resources that can be required by applications and policed by hosting providers";
-      type = attrsOf resource;
+      type = attrsOf (
+        submodule (
+          { ... }:
+          {
+            _class = "fediversity-resource";
+            options = {
+              description = mkOption {
+                description = "Description of the resource to help application module authors and hosting providers to work with it";
+                type = types.str;
+              };
+              request = mkOption {
+                description = "Options for declaring resource requirements by an application, a description of how the resource is consumed or accessed";
+                type = deferredModuleWith { staticModules = [ { _class = "fediversity-resource-request"; } ]; };
+              };
+              policy = mkOption {
+                description = "Options for configuring the resource policy for the hosting provider, a description of how the resource is made available";
+                type = deferredModuleWith {
+                  staticModules = [
+                    {
+                      _class = "fediversity-resource-policy";
+                      options.apply = mkOption {
+                        description = "Apply the policy to a request";
+                      };
+                    }
+                  ];
+                };
+              };
+            };
+          }
+        )
+      );
     };
     applications = mkOption {
-      description = "Collection of (available) Fediversity applications";
+      description = "Collection of Fediversity applications";
-      type = attrsOf application;
+      type = attrsOf (
+        submodule (application: {
+          _class = "fediversity-application";
+          options = {
+            description = mkOption {
+              description = "Description to be shown in the application overview";
+              type = types.str;
+            };
+            module = mkOption {
+              description = "Operator-facing configuration options for the application";
+              type = deferredModuleWith { staticModules = [ { _class = "fediversity-application-config"; } ]; };
+            };
+            implementation = mkOption {
+              description = "Mapping of application configuration to deployment resources, a description of what an application needs to run";
+              type = application.config.config-mapping.function-type;
+            };
+            resources = mkOption {
+              description = "Compute resources required by an application";
+              type = functionTo application.config.config-mapping.output-type;
+              readOnly = true;
+              default = input: (application.config.implementation input).output;
+            };
+            config-mapping = mkOption {
+              description = "Function type for the mapping from application configuration to required resources";
+              type = submodule functionType;
+              readOnly = true;
+              default = {
+                input-type = application.config.module;
+                output-type = application-resources;
+              };
+            };
+          };
+        })
+      );
+    };
+    environments = mkOption {
+      description = "Run-time environments for Fediversity applications to be deployed to";
+      type = attrsOf (
+        submodule (environment: {
+          _class = "fediversity-environment";
+          options = {
+            resources = mkOption {
+              description = ''
+                Resources made available by the hosting provider, and their policies.
+
+                Setting this is optional, but provides a place to declare that information for programmatic use in the resource mapping.
+              '';
+              # TODO: maybe transpose, and group the resources by type instead
+              type = attrsOf (
+                attrTag (
+                  lib.mapAttrs' (name: resource: {
+                    ${name} = mkOption { type = resource.policy; };
+                  }) config.resources
+                )
+              );
+            };
+            implementation = mkOption {
+              description = "Mapping of resources required by applications to available resources; the result can be deployed";
+              type = environment.config.resource-mapping.function-type;
+            };
+            resource-mapping = mkOption {
+              description = "Function type for the mapping from resources to a (NixOps4) deployment";
+              type = submodule functionType;
+              readOnly = true;
+              default = {
+                input-type = application-resources;
+                output-type = nixops4Deployment;
+              };
+            };
+            deployment = mkOption {
+              description = "Generate a deployment from a configuration";
+              type = functionTo environment.config.resource-mapping.output-type;
+              readOnly = true;
+              default =
+                cfg:
+                # TODO: check cfg.enable.true
+                let
+                  required-resources = lib.mapAttrs (
+                    name: application-settings: config.applications.${name}.resources application-settings
+                  ) cfg.applications;
+                in
+                (environment.config.implementation required-resources).output;
+
+            };
+          };
+        })
+      );
+    };
+    configuration = mkOption {
+      description = "Configuration type declaring options to be set by operators";
+      type = optionType;
+      readOnly = true;
+      default = submodule {
+        options = {
+          enable = lib.mkEnableOption {
+            description = "your Fediversity configuration";
+          };
+          applications = lib.mapAttrs (
+            _name: application:
+            mkOption {
+              description = application.description;
+              type = submodule application.module;
+              default = { };
+            }
+          ) config.applications;
         };
-    deployments = mkOption {
-      description = "Deployment of a configuration of applications to a run-time environment";
-      type = attrsOf deployment;
       };
-    migrations = mkOption {
-      description = "Migrations from Fediversity deployments to Fediversity run-time environments";
-      type = attrsOf migration;
     };
   };
 }

deployment/function.nix

@@ -0,0 +1,39 @@
+/**
+  Modular function type
+*/
+{ config, lib, ... }:
+let
+  inherit (lib) mkOption types;
+  inherit (types)
+    deferredModule
+    submodule
+    functionTo
+    optionType
+    ;
+in
+{
+  options = {
+    input-type = mkOption {
+      type = deferredModule;
+    };
+    output-type = mkOption {
+      type = deferredModule;
+    };
+    function-type = mkOption {
+      type = optionType;
+      readOnly = true;
+      default = functionTo (
+        submodule (function: {
+          options = {
+            input = mkOption {
+              type = submodule config.input-type;
+            };
+            output = mkOption {
+              type = submodule config.output-type;
+            };
+          };
+        })
+      );
+    };
+  };
+}