add a new updater output

this is so that we don't have to obfuscate store paths in
systemConfiguration to avoid dragging in build system
deps.

breaking-ish change to workflows, docs updated

modules/outputs/updater/default.nix

@@ -0,0 +1,36 @@
+{
+  config
+, pkgs
+, lib
+, ...
+}:
+let
+  inherit (lib) mkIf;
+  o = config.system.outputs;
+  inherit (pkgs) runCommand;
+  inherit (lib) mkOption types;
+  inherit (pkgs.buildPackages) min-copy-closure;
+in
+{
+  imports = [ ../system-configuration.nix ];
+  options.system.outputs.updater = mkOption {
+    type = types.package;
+    description = ''
+      updater
+      ******
+
+      For configurations with a writable filesystem, create a shell
+      script that runs on the build system and updates the device
+      over the network to the new configuration
+    '';
+  };
+
+  config.system.outputs.updater =
+    runCommand "buildUpdater" { } ''
+      mkdir -p $out/bin
+      substitute ${./update.sh} $out/bin/update.sh \
+         --subst-var-by toplevel ${o.systemConfiguration} \
+         --subst-var-by min_copy_closure ${min-copy-closure}
+      chmod +x  $out/bin/update.sh
+    '';
+}

modules/outputs/updater/update.sh

@@ -0,0 +1,51 @@
+#!/usr/bin/env bash
+
+# this shell script is run on the build system to min-copy-closure the
+# system configuration onto the device and reboot/restart services as
+# requested
+
+die() {
+    echo "$@"
+    exit 1
+}
+
+
+PATH=@min_copy_closure@/bin:$PATH
+ssh_command=${SSH_COMMAND-ssh}
+
+reboot="reboot"
+case "$1" in
+    "--no-reboot")
+	unset reboot
+	shift
+	;;
+    "--fast")
+	reboot="soft"
+	shift
+	;;
+esac
+
+target_host=$1
+shift
+
+test -n "$target_host" || \
+    die "Usage: $0 [--no-reboot] [--fast] target-host"
+
+toplevel=$(realpath @toplevel@)
+test -e $toplevel/etc/nix-store-paths || die "missing etc/nix-store-paths, is this really a system configuration?"
+echo installing from systemConfiguration $toplevel to host $target_host
+
+$ssh_command $target_host uname -a || die "Can't ssh to $target_host"
+min-copy-closure $target_host $toplevel
+set -x
+$ssh_command $target_host $toplevel/bin/install
+case "$reboot" in
+    reboot)
+	$ssh_command $target_host "sync; source /etc/profile; reboot"
+	;;
+    soft)
+	$ssh_command $target_host $toplevel/bin/restart-services
+	;;
+    *)
+	;;
+esac