fix(nixos): import unsigned deploy closures

configs/nixos/modules/shell/fish/functions/deploy-to.fish

@@ -34,10 +34,40 @@ if test (count $system_path) -ne 1
     return 1
 end
 
-echo "deploy-to: copying $system_path to $host" >&2
-nix copy --to ssh://$host $system_path
+set nar_file (mktemp --suffix=.nar)
+or return $status
+set remote_nar "/tmp/deploy-to-$host-"(date +%s)"-$fish_pid.nar"
+
+set closure_paths (nix-store -qR $system_path)
 or begin
-    echo "deploy-to: copy failed for $host" >&2
+    set query_status $status
+    rm -f $nar_file
+    echo "deploy-to: closure query failed for $host" >&2
+    return $query_status
+end
+
+echo "deploy-to: exporting closure for $system_path" >&2
+nix-store --export $closure_paths >$nar_file
+or begin
+    set export_status $status
+    rm -f $nar_file
+    echo "deploy-to: closure export failed for $host" >&2
+    return $export_status
+end
+
+echo "deploy-to: copying closure archive to $host:$remote_nar" >&2
+scp $nar_file $host:$remote_nar
+set scp_status $status
+rm -f $nar_file
+if test $scp_status -ne 0
+    echo "deploy-to: closure archive copy failed for $host" >&2
+    return $scp_status
+end
+
+echo "deploy-to: importing closure on $host" >&2
+ssh -t $host "sudo sh -c 'nix-store --import < $remote_nar' && rm -f $remote_nar"
+or begin
+    echo "deploy-to: closure import failed for $host" >&2
     return $status
 end