You do not hand-translate nagios.cfg. jaque ships a compiler frontend that reads a Nagios object tree, resolves its inheritance, and emits native CUE together with a migration report naming every object that did not make it across unchanged. The output is a config you own from then on; there is no legacy-config runtime mode. This page covers the fast path through the importer and how to read its report.

Status: the importer is implemented and property-tested for round-trip correctness, but it has never been run against a real third-party Nagios configuration, because the project has no corpus. Treat its output as a strong first draft that still needs verifying. See Status.

1. The fast path

jaque import -from nagios -o jaque.cue /etc/nagios/

The positional argument is a directory, in which case jaque looks for nagios.cfg inside it, or a single file. -from accepts nagios and nautobot. The second reads a device inventory and is described in Nautobot import. Icinga 2 is next on the plan; it has not shipped. -o writes the emitted CUE to a file instead of stdout, which is what you want for anything past a first look.

2. What comes out

Two artefacts, on two streams, so that jaque import ... > jaque.cue captures the config and never the report mixed into it.

The CUE itself, on stdout or in the -o file: hosts, services, checks, contacts, notification policies, escalations and labels, the whole object graph. Where the source repeats itself the importer emits shared templates rather than a flat one-object-per-line dump, so the result reads like a config someone wrote by hand.

The migration report, on stderr: every source object classified as exactly one of mapped, approximated or unsupported. An approximated object was translated but something changed, and the report says what. An unsupported object was dropped, and the report gives the source file:line so you can go and look. The header line reads objects: N emitted of M in source (P% survived), which is the one number to read first.

Nothing here executes your Nagios config. The importer is a compiler frontend (ADR-006): it parses to an intermediate representation and emits CUE from it. Importer has the mapping rules; Overview has the reason the boundary is drawn there.

3. What to expect the first time

A real Nagios tree carries two decades of use chains, custom variables and Perl-flavoured check_command macros, and none of that is theoretical. The importer resolves inheritance itself: use chains, register 0 templates, +value appends, null unsets. It translates check_command with its $ARGn$ and $USERn$ macros into jaque checks, and turns hostgroups into labels.

What it has not done is meet a stranger's config. Until it has, read the report before the output: anything marked unsupported is a gap you must fill by hand, and anything approximated is a decision the importer made that you may disagree with. If you run Nagios and want to point jaque import at your object files, reporting what broke is the most useful thing you could send the project right now.

4. Validate what you got

The emitted CUE is an ordinary jaque config, so validation is the same command as running it, jaque -config jaque.cue:

jaque -config jaque.cue

Validation runs in two phases, described in Why CUE: constraints at build, concretion at load. A bad field name or a wrong type fails at startup with an error naming the exact field, before a single check runs. A config that passes both phases is one the engine will schedule.

Once it is running, #/hosts and #/services in the dashboard are the fastest way to confirm that what you expected to see is what arrived. See Dashboard.

5. Security considerations

The importer reads files and writes files; it opens no listener and executes nothing it reads. check_command lines are translated, never run, so a hostile object file can produce a wrong config but not a process. Macros from resource.cfg such as $USERn$ frequently hold credentials: the emitted CUE carries them in plain text exactly as the source did, so give the output the same file permissions you gave the input.