> Section: [1. Introduction](https://jaque.sh/docs/get-started/quickstart.md)
> Next: concepts/architecture
> Index: https://jaque.sh/llms.txt


You do not hand-translate `nagios.cfg`. jaque ships a compiler frontend
that reads a Nagios object tree, resolves its inheritance, and emits native
CUE together with a migration report naming every object that did not make
it across unchanged. The output is a config you own from then on; there is
no legacy-config runtime mode and never will be. This page is the fast
path through the importer and the honest reading of its report.

Status: the importer is implemented and property-tested for round-trip
correctness, but it has never been run against a real third-party Nagios
configuration, because the project has no corpus. Treat its output as a
strong first draft, not a verified translation. See
[Status](https://jaque.sh/docs/project/status.md).

## 1. The fast path

```sh
jaque import -from nagios /etc/nagios/ -o jaque.cue
```

The positional argument is a directory, in which case jaque looks for
`nagios.cfg` inside it, or a single file. `-from` accepts only `nagios`
today; the pipeline is built to host more than one frontend, and Icinga 2
is the next one planned, not the one shipped. `-o` writes the emitted CUE
to a file instead of stdout, which is what you want for anything past a
first look.

## 2. What comes out

Two artefacts, on two streams, so that `jaque import ... > jaque.cue`
captures the config and never the report mixed into it.

The CUE itself, on stdout or in the `-o` file: hosts, services, checks,
contacts, notification policies, escalations and labels, the whole object
graph. Where the source repeats itself the importer emits shared templates
rather than a flat one-object-per-line dump, so the result reads like a
config someone wrote, not one a tool generated.

The migration report, on stderr: every source object classified as exactly
one of `mapped`, `approximated` or `unsupported`. An approximated object
was translated but something changed, and the report says what. An
unsupported object was dropped, and the report gives the source
`file:line` so you can go and look. The header line reads `objects: N
emitted of M in source (P% survived)`, which is the one number to read
first.

Nothing here executes your Nagios config. The importer is a compiler
frontend (ADR-006): it parses to an intermediate representation and emits
CUE from it. [Importer](https://jaque.sh/docs/nagios-compat/importer.md) has the mapping
rules; [Overview](https://jaque.sh/docs/nagios-compat/overview.md) has the reason the
boundary is drawn there.

## 3. What to expect the first time

A real Nagios tree carries two decades of `use` chains, custom variables
and Perl-flavoured `check_command` macros, and none of that is
theoretical. The importer resolves inheritance itself -- `use` chains,
`register 0` templates, `+value` appends, `null` unsets -- translates
`check_command` with its `$ARGn$` and `$USERn$` macros into jaque checks,
and turns hostgroups into labels.

What it has not done is meet a stranger's config. Until it has, read the
report before the output: anything marked `unsupported` is a gap you must
fill by hand, and anything `approximated` is a decision the importer made
that you may disagree with. If you run Nagios and want to point `jaque
import` at your object files, reporting what broke is the most useful
thing you could send the project right now.

## 4. Validate what you got

The emitted CUE is an ordinary jaque config, so validation is the same
command as running it, `jaque -config jaque.cue`:

```sh
jaque -config jaque.cue
```

Validation runs in two phases, described in [Why
CUE](../concepts/why-cue.md): constraints at build, concretion at load. A
bad field name or a wrong type fails at startup with an error naming the
exact field, before a single check runs. A config that passes both phases
is one the engine will schedule.

Once it is running, `#/hosts` and `#/services` in the dashboard are the
fastest way to confirm that what you expected to see is what arrived. See
[Dashboard](https://jaque.sh/docs/ui/dashboard.md).

## 5. Security considerations

The importer reads files and writes files; it opens no listener and
executes nothing it reads. `check_command` lines are translated, never
run, so a hostile object file can produce a wrong config but not a process.
Macros from `resource.cfg` such as `$USERn$` frequently hold credentials:
the emitted CUE carries them in plain text exactly as the source did, so
give the output the same file permissions you gave the input.