So one either needs to set nix.settings.trusted-users to the targetUser or use root as the targetUser?

In reply to @me:indeednotjames.com

anyone else noticing that targets in a flake don't substitute from cache.nixos.org when running colmena apply?
I haven't investigated further yet.
But I did notice that disabling nix copy seems to fix it 👀

really dump patch, as there is no cmd flag to disable it (running latest main):

diff --git a/src/nix/host/ssh.rs b/src/nix/host/ssh.rs
index d45ed99..1b33717 100644
--- a/src/nix/host/ssh.rs
+++ b/src/nix/host/ssh.rs
@@ -261,7 +261,7 @@ impl Ssh {
         let ssh_options = self.ssh_options();
         let ssh_options_str = ssh_options.join(" ");
 
-        let mut command = if self.use_nix3_copy {
+        let mut command = if false {
             // experimental `nix copy` command with ssh-ng://
             let mut command = Command::new("nix");

In reply to @julian:nekover.se
That makes sense, thanks!
What I'm wondering now, is how to make sure my systems are up-to-date then. Some kind of automated deployment from some deployment system, which automatically updates the flake.lock?
What are you all doing?

Hey,
how do I reference another option when using colmena? I want to set the dhparams path for the nginx service to the value of the security.dhparams.params.nginx.pathoption (which is readOnly anyways).

In nixos, that would be config.. I tried that host. and config.host. but it doesnt work like that.

In reply to @zhaofeng:zhaofeng.li
It definitely should work. What does your config look like?