2 files changed, 65 insertions, 12 deletions
diff --git a/hosts/sagittarius/auto-update.nix b/hosts/sagittarius/auto-update.nix
new file mode 100644
index 0000000..4e8c2ac
--- /dev/null
+++ b/hosts/sagittarius/auto-update.nix
@@ -0,0 +1,64 @@
+{ pkgs, ... }:
+let
+  configRepoSource = "file:///var/lib/git/repos/isabella/nixos-config";
+in
+{
+  systemd.timers.auto-update-nixos = {
+    enable = true;
+    description = "Timer that automatically fetches and updates the NixOS config.";
+    timerConfig = {
+      Unit = "update-nixos.service";
+      OnUnitActiveSec = "60s";
+    };
+    wantedBy = [ "mutli-user.target" ];
+  };
+
+  systemd.services.update-nixos = {
+    enable = true;
+    description = "Services that fetches and updates the NixOS config.";
+    serviceConfig = {
+      Type = "oneshot";
+      User = "root";
+      StandardOutput = "journal";
+      StandardError = "journal";
+    };
+    path = [ pkgs.gitMinimal pkgs.nixos-rebuild-ng ];
+    # we need root privileges for a system update anyway
+    confinement.enable = false;
+
+    enableStrictShellChecks = true;
+    script = ''
+      #!/bin/sh
+      set -xeu
+
+      SRCREPO="$1"
+      if [ -z "$SRCREPO" ]; then
+        echo "Error: git repository source was not provided." >&2
+        exit 1
+      fi
+
+      TEMPDIR="$(mktemp --directory)"
+      git clone --depth 1 "$SRCREPO" "$TEMPDIR"
+
+      pushd "$TEMPDIR"
+
+      TAGS="$(git tag --sort tag --list 'v*')"
+      LATESTTAG="$(echo "$TAGS" | head --lines 1)"
+
+      if [ -z "$LATESTTAG" ]; then
+        echo "Error: no release tags defined." >&2
+        exit 1
+      fi
+
+      git fetch "$SRCREPO" "$LATESTTAG"
+      git checkout FETCH_HEAD
+
+      nixos-rebuild switch --flake .#
+
+      popd
+
+      rm -rf "$TEMPDIR"
+    '';
+    scriptArgs = "${configRepoSource}";
+  };
+}
diff --git a/hosts/sagittarius/default.nix b/hosts/sagittarius/default.nix
index e55bb3e..8c98a0e 100644
--- a/hosts/sagittarius/default.nix
+++ b/hosts/sagittarius/default.nix
@@ -12,6 +12,7 @@
     ./sops.nix
     ./network.nix
     ./headscale.nix
+    ./auto-update.nix
   ];
 
   boot.loader.grub.device = "/dev/sda";
@@ -30,18 +31,6 @@
     SystemMaxUse=100M
   '';
 
-  # services.comin = {
-  #   enable = true;
-  #   remotes = [
-  #     {
-  #       name = "origin";
-  #       url = "https://git.sorre.xyz/miranb/nixos-config.git";
-  #       branches.main.name = "main";
-  #       auth.access_token_path = config.sops.secrets."sorre-forgejo-access-token".path;
-  #     }
-  #   ];
-  # };
-
   # Select internationalisation properties.
   i18n.defaultLocale = "en_US.UTF-8";