comment on applications

allows declaring options so instantiations may configure required
settings

deployment/data-model-test.nix

@@ -11,16 +11,25 @@ let
     }).config;
 in
 {
+  _class = "nix-unit";
+
   test-eval = {
     expr =
       let
         example = eval {
-          runtime-environments.bar.nixos = {
-            module =
-              { ... }:
-              {
-                system.stateVersion = "25.05";
+          runtime-configurations.single-ssh-host =
+            { ... }:
+            {
+              system.stateVersion = "25.05";
+            };
+          runtime-environments.bar = {
+            single-ssh-host = {
+              ssh = {
+                host = "localhost";
+                username = "root";
+                authentication.password = "";
               };
+            };
           };
           applications.foo = {
             module =
@@ -34,11 +43,13 @@ in
         };
       in
       {
-        has-runtime = lib.isAttrs example.runtime-environments.bar.nixos.module;
+        has-runtime-configuration = lib.isAttrs example.runtime-configurations.single-ssh-host;
+        has-runtime-environment = lib.isAttrs example.runtime-environments.bar.single-ssh-host.module;
         has-application = lib.isAttrs example.applications.foo.module;
       };
     expected = {
-      has-runtime = true;
+      has-runtime-configuration = true;
+      has-runtime-environment = true;
       has-application = true;
     };
   };

deployment/data-model.nix

@@ -1,43 +1,126 @@
 {
   lib,
+  config,
   ...
 }:
 let
-  inherit (lib) types mkOption;
-in
-with types;
-{
-  options = {
-    runtime-environments = mkOption {
-      description = "Collection of runtime environments into which applications can be deployed";
-      type = attrsOf (attrTag {
-        nixos = mkOption {
-          description = "A single NixOS machine";
+  inherit (lib)
+    attrNames
+    mapAttrs
+    mkOption
+    genAttrs
+    ;
+  inherit (lib.types)
+    attrsOf
+    attrTag
+    deferredModule
+    mergeTypes
+    nullOr
+    submoduleWith
+    submodule
+    str
+    ;
+  runtime-configuration = mkOption {
+    description = "The NixOS module of a run-time environment";
+    type = deferredModule;
+    default = {
+      _class = "nixos";
+    };
+  };
+  runtime-environment = attrTag (
+    mapAttrs
+      (
+        name:
+        option@{ type, ... }:
+        mkOption (
+          option
+          // {
+            type = mergeTypes type (submodule {
+              options.module = mkOption {
+                description = "The NixOS module of the run-time environment";
+                type = deferredModule;
+                default = config.runtime-configurations.${name};
+                readOnly = true;
+              };
+            });
+          }
+        )
+      )
+      {
+        vm = {
+          description = "A VM to deploy to.";
           type = submodule {
             options = {
-              module = mkOption {
-                description = "The NixOS module describing the base configuration for that machine";
-                type = deferredModule;
+            };
+          };
+        };
+        single-ssh-host = {
+          description = "A single host to deploy to by SSH.";
+          type = submodule {
+            options = {
+              ssh = mkOption {
+                description = "SSH connection info";
+                type = submodule {
+                  options = {
+                    host = mkOption {
+                      description = "the host to access by SSH";
+                      type = str;
+                    };
+                    username = mkOption {
+                      description = "the SSH user to use";
+                      type = nullOr str;
+                      default = null;
+                    };
+                    authentication = mkOption {
+                      description = "authentication method";
+                      type = attrsOf (attrTag {
+                        private-key = mkOption {
+                          description = "path to the user's SSH private key";
+                          type = str;
+                          example = "/root/.ssh/id_ed25519";
+                        };
+                        password = mkOption {
+                          description = "SSH password";
+                          # TODO: mark as sensitive
+                          type = str;
+                        };
+                      });
+                    };
+                  };
+                };
               };
             };
           };
         };
-      });
+      }
+  );
+  application = submoduleWith {
+    description = "A Fediversity application";
+    modules = [
+      {
+        options = {
+          module = mkOption {
+            description = "The NixOS module for that application, for configuring that application";
+            type = deferredModule;
+          };
+        };
+      }
+    ];
+  };
+in
+{
+  options = {
+    runtime-configurations = mkOption {
+      description = "Collection of runtime environments into which applications can be deployed";
+      type = attrTag (genAttrs (attrNames runtime-environment.nestedTypes) (_: runtime-configuration));
+    };
+    runtime-environments = mkOption {
+      description = "Collection of runtime environments into which applications can be deployed";
+      type = attrsOf runtime-environment;
     };
     applications = mkOption {
       description = "Collection of Fediversity applications";
-      type = attrsOf (submoduleWith {
-        modules = [
-          {
-            options = {
-              module = mkOption {
-                description = "The NixOS module for that application, for configuring that application";
-                type = deferredModule;
-              };
-            };
-          }
-        ];
-      });
+      type = attrsOf application;
     };
   };
 }

deployment/options.nix

@@ -8,6 +8,8 @@
   This can be fixed if we made the converter aware of [`$defs`], but that would likely amount to half a rewrite.
 
   [`$defs`]: https://json-schema.org/understanding-json-schema/structuring#defs
+
+  An example deployment configuration may be found at `configuration.sample.json`.
 */
 {
   lib,