fix: Lazily fetch external modules only if needed

fleet/default.nix

@@ -36,8 +36,20 @@ let
       externalModulePath =
         if externalModuleThunk != null then
           let
-            # Force evaluation of the thunk (fetchGit, fetchTarball, etc.)
-            fetchedPath = externalModuleThunk;
+            # Force evaluation of the thunk
+            fetchedPath =
+              if
+                builtins.isAttrs externalModuleThunk
+                && externalModuleThunk ? _type
+                && externalModuleThunk._type == "lazy-fetchGit"
+              then
+                # New format: lazy fetchGit - only execute when needed
+                (builtins.fetchGit {
+                  inherit (externalModuleThunk) url rev submodules;
+                }).outPath
+              else
+                # Legacy: pre-fetched derivation or path
+                externalModuleThunk;
             # Extract outPath from fetchGit/fetchTarball results
             extractedPath =
               if builtins.isAttrs fetchedPath && fetchedPath ? outPath then fetchedPath.outPath else fetchedPath;
@@ -61,10 +73,19 @@ let
           name: user:
           if (user ? external && user.external != null) then
             let
+              # Resolve external path (lazy fetchGit if needed)
               externalPath =
-                if builtins.isAttrs user.external && user.external ? outPath then
+                if builtins.isAttrs user.external && user.external ? url && user.external ? rev then
+                  # New format: lazy fetchGit
+                  (builtins.fetchGit {
+                    inherit (user.external) url rev;
+                    submodules = user.external.submodules or false;
+                  }).outPath
+                else if builtins.isAttrs user.external && user.external ? outPath then
+                  # Legacy: pre-fetched
                   user.external.outPath
                 else
+                  # Direct path
                   user.external;
               nixosModulePath = externalPath + "/nixos.nix";
             in
@@ -205,8 +226,24 @@ let
             # Check if deviceConfig has an 'external' field for lazy evaluation
             hasExternalField = builtins.isAttrs deviceConfig && deviceConfig ? external;
 
-            # Extract external module thunk if present (don't evaluate yet!)
-            externalModuleThunk = if hasExternalField then deviceConfig.external else null;
+            # Extract external module spec (don't evaluate fetchGit yet!)
+            externalModuleThunk =
+              if hasExternalField then
+                let
+                  ext = deviceConfig.external;
+                in
+                # New format: { url, rev, submodules? } - create lazy fetchGit thunk
+                if builtins.isAttrs ext && ext ? url && ext ? rev then
+                  {
+                    _type = "lazy-fetchGit";
+                    inherit (ext) url rev;
+                    submodules = ext.submodules or false;
+                  }
+                # Legacy: pre-fetched or path
+                else
+                  ext
+              else
+                null;
 
             # Remove 'external' from config to avoid conflicts
             cleanDeviceConfig =

fleet/fleet-option.nix

@@ -125,21 +125,45 @@ let
         type = lib.types.nullOr (
           lib.types.oneOf [
             lib.types.path
-            lib.types.package
-            lib.types.attrs
+            (lib.types.submodule {
+              options = {
+                url = lib.mkOption {
+                  type = lib.types.str;
+                  description = "Git repository URL to fetch user configuration from.";
+                  example = "https://github.com/username/dotfiles";
+                };
+                rev = lib.mkOption {
+                  type = lib.types.str;
+                  description = "Git commit hash, tag, or branch to fetch.";
+                  example = "abc123def456...";
+                };
+                submodules = lib.mkOption {
+                  type = lib.types.bool;
+                  default = false;
+                  description = "Whether to fetch Git submodules.";
+                };
+              };
+            })
           ]
         );
         default = null;
         description = ''
           External user configuration module from Git or local path.
 
+          Can be either:
+          - A local path: /path/to/config
+          - A Git repository: { url = "..."; rev = "..."; submodules? = false; }
+
+          The Git repository is only fetched when the user is actually enabled.
+
           Should contain user.nix (user options + home-manager config)
           and optionally nixos.nix (system-level config).
         '';
         example = lib.literalExpression ''
-          builtins.fetchGit {
+          {
                     url = "https://github.com/username/dotfiles";
-                    rev = "abc123...";
+                    rev = "abc123def456789abcdef0123456789abcdef012";
+                    submodules = false;
                   }'';
       };
       opensshKeys = lib.mkOption {

fleet/user-config.nix

@@ -13,13 +13,21 @@
 # Options are defined in fleet-option.nix for early availability.
 
 let
-  # Helper: Resolve external module path from fetchGit/fetchTarball/path
+  # Helper: Resolve external module path (with lazy Git fetching)
   resolveExternalPath =
     external:
     if external == null then
       null
+    # New format: { url, rev, submodules? } - only fetch when needed
+    else if builtins.isAttrs external && external ? url && external ? rev then
+      (builtins.fetchGit {
+        inherit (external) url rev;
+        submodules = external.submodules or false;
+      }).outPath
+    # Legacy: pre-fetched derivation/package
     else if builtins.isAttrs external && external ? outPath then
       external.outPath
+    # Direct path
     else
       external;