1 files changed, 64 insertions, 0 deletions
diff --git a/hosts/sagittarius/auto-update.nix b/hosts/sagittarius/auto-update.nix
new file mode 100644
index 0000000..4e8c2ac
--- /dev/null
+++ b/hosts/sagittarius/auto-update.nix
@@ -0,0 +1,64 @@
+{ pkgs, ... }:
+let
+  configRepoSource = "file:///var/lib/git/repos/isabella/nixos-config";
+in
+{
+  systemd.timers.auto-update-nixos = {
+    enable = true;
+    description = "Timer that automatically fetches and updates the NixOS config.";
+    timerConfig = {
+      Unit = "update-nixos.service";
+      OnUnitActiveSec = "60s";
+    };
+    wantedBy = [ "mutli-user.target" ];
+  };
+
+  systemd.services.update-nixos = {
+    enable = true;
+    description = "Services that fetches and updates the NixOS config.";
+    serviceConfig = {
+      Type = "oneshot";
+      User = "root";
+      StandardOutput = "journal";
+      StandardError = "journal";
+    };
+    path = [ pkgs.gitMinimal pkgs.nixos-rebuild-ng ];
+    # we need root privileges for a system update anyway
+    confinement.enable = false;
+
+    enableStrictShellChecks = true;
+    script = ''
+      #!/bin/sh
+      set -xeu
+
+      SRCREPO="$1"
+      if [ -z "$SRCREPO" ]; then
+        echo "Error: git repository source was not provided." >&2
+        exit 1
+      fi
+
+      TEMPDIR="$(mktemp --directory)"
+      git clone --depth 1 "$SRCREPO" "$TEMPDIR"
+
+      pushd "$TEMPDIR"
+
+      TAGS="$(git tag --sort tag --list 'v*')"
+      LATESTTAG="$(echo "$TAGS" | head --lines 1)"
+
+      if [ -z "$LATESTTAG" ]; then
+        echo "Error: no release tags defined." >&2
+        exit 1
+      fi
+
+      git fetch "$SRCREPO" "$LATESTTAG"
+      git checkout FETCH_HEAD
+
+      nixos-rebuild switch --flake .#
+
+      popd
+
+      rm -rf "$TEMPDIR"
+    '';
+    scriptArgs = "${configRepoSource}";
+  };
+}