You do not hand-translate nagios.cfg. jaque ships a compiler frontend that reads a Nagios object tree, resolves its inheritance, and emits native CUE together with a migration report naming every object that did not make it across unchanged. The output is a config you own from then on; there is no legacy-config runtime mode and never will be. This page is the fast path through the importer and the honest reading of its report.

Status: the importer is implemented and property-tested for round-trip correctness, but it has never been run against a real third-party Nagios configuration, because the project has no corpus. Treat its output as a strong first draft, not a verified translation. See Status.

1. The fast path

jaque import -from nagios /etc/nagios/ -o jaque.cue

The positional argument is a directory, in which case jaque looks for nagios.cfg inside it, or a single file. -from accepts only nagios today; the pipeline is built to host more than one frontend, and Icinga 2 is the next one planned, not the one shipped. -o writes the emitted CUE to a file instead of stdout, which is what you want for anything past a first look.

2. What comes out

Two artefacts, on two streams, so that jaque import ... > jaque.cue captures the config and never the report mixed into it.

The CUE itself, on stdout or in the -o file: hosts, services, checks, contacts, notification policies, escalations and labels, the whole object graph. Where the source repeats itself the importer emits shared templates rather than a flat one-object-per-line dump, so the result reads like a config someone wrote, not one a tool generated.

The migration report, on stderr: every source object classified as exactly one of mapped, approximated or unsupported. An approximated object was translated but something changed, and the report says what. An unsupported object was dropped, and the report gives the source file:line so you can go and look. The header line reads objects: N emitted of M in source (P% survived), which is the one number to read first.

Nothing here executes your Nagios config. The importer is a compiler frontend (ADR-006): it parses to an intermediate representation and emits CUE from it. Importer has the mapping rules; Overview has the reason the boundary is drawn there.

3. What to expect the first time

A real Nagios tree carries two decades of use chains, custom variables and Perl-flavoured check_command macros, and none of that is theoretical. The importer resolves inheritance itself -- use chains, register 0 templates, +value appends, null unsets -- translates check_command with its $ARGn$ and $USERn$ macros into jaque checks, and turns hostgroups into labels.

What it has not done is meet a stranger's config. Until it has, read the report before the output: anything marked unsupported is a gap you must fill by hand, and anything approximated is a decision the importer made that you may disagree with. If you run Nagios and want to point jaque import at your object files, reporting what broke is the most useful thing you could send the project right now.

4. Validate what you got

The emitted CUE is an ordinary jaque config, so validation is the same command as running it, jaque -config jaque.cue:

jaque -config jaque.cue

Validation runs in two phases, described in Why CUE: constraints at build, concretion at load. A bad field name or a wrong type fails at startup with an error naming the exact field, before a single check runs. A config that passes both phases is one the engine will schedule.

Once it is running, #/hosts and #/services in the dashboard are the fastest way to confirm that what you expected to see is what arrived. See Dashboard.

5. Security considerations

The importer reads files and writes files; it opens no listener and executes nothing it reads. check_command lines are translated, never run, so a hostile object file can produce a wrong config but not a process. Macros from resource.cfg such as $USERn$ frequently hold credentials: the emitted CUE carries them in plain text exactly as the source did, so give the output the same file permissions you gave the input.