{ pkgs, ... }:
let
  configRepoSource = "file:///var/lib/git/repos/isabella/nixos-config";
in
{
  systemd.timers.auto-update-nixos = {
    enable = true;
    description = "Timer that automatically fetches and updates the NixOS config.";
    timerConfig = {
      Unit = "update-nixos.service";
      OnUnitActiveSec = "60s";
    };
    wantedBy = [ "mutli-user.target" ];
  };

  systemd.services.update-nixos = {
    enable = true;
    description = "Services that fetches and updates the NixOS config.";
    serviceConfig = {
      Type = "oneshot";
      User = "root";
      StandardOutput = "journal";
      StandardError = "journal";
    };
    path = [ pkgs.gitMinimal pkgs.nixos-rebuild-ng ];
    # we need root privileges for a system update anyway
    confinement.enable = false;

    enableStrictShellChecks = true;
    script = ''
      #!/bin/sh
      set -eu

      SRCREPO="$1"
      if [ -z "$SRCREPO" ]; then
        echo "Error: git repository source was not provided." >&2
        exit 1
      fi

      TEMPDIR="$(mktemp --directory)"
      git clone --depth 1 "$SRCREPO" "$TEMPDIR"

      pushd "$TEMPDIR"

      TAGS="$(git tag --sort tag --list 'v*')"
      LATESTTAG="$(echo "$TAGS" | tail --lines 1)"

      if [ -z "$LATESTTAG" ]; then
        echo "Error: no release tags defined." >&2
        exit 1
      fi

      git fetch "$SRCREPO" "$LATESTTAG"
      git checkout FETCH_HEAD

      CURRENT_REV="$(git rev-parse HEAD)"
      mkdir -p /var/lib/auto-update/

      if [ -e /var/lib/auto-update/last-commit ]; then
        LAST_REV="$(cat /var/lib/auto-update/last-commit)"
        if [ "$CURRENT_REV" = "$LAST_REV" ]; then
          echo "System is already up to date. Exiting." >&2
          exit 0
        fi
      fi
      echo -n "$CURRENT_REV" > /var/lib/auto-update/last-commit

      nixos-rebuild switch --flake .#

      popd

      rm -rf "$TEMPDIR"
    '';
    scriptArgs = "${configRepoSource}";
  };
}