blob: dfe9ab817cffa6773252b776a8f630220650d1e8 (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
|
{ pkgs, ... }:
let
configRepoSource = "file:///var/lib/git/repos/isabella/nixos-config";
in
{
systemd.timers.auto-update-nixos = {
enable = true;
description = "Fetch and update the NixOS config every minute";
timerConfig = {
Unit = "update-nixos.service";
OnUnitActiveSec = "60s";
};
wantedBy = [ "mutli-user.target" ];
};
systemd.services.update-nixos = {
enable = true;
description = "Fetches and update the NixOS config";
serviceConfig = {
Type = "oneshot";
User = "root";
StandardOutput = "journal";
StandardError = "journal";
};
path = [ pkgs.gitMinimal pkgs.nixos-rebuild-ng ];
# we need root privileges for a system update anyway
confinement.enable = false;
enableStrictShellChecks = true;
script = ''
#!/bin/sh
set -eu
SRC_REPO="$1"
if [ -z "$SRC_REPO" ]; then
echo "Error: git repository source was not provided." >&2
exit 1
fi
TEMP_DIR="$(mktemp --directory)"
git clone --depth 1 "$SRC_REPO" "$TEMP_DIR"
pushd "$TEMP_DIR"
TAGS="$(git tag --sort tag --list 'v*')"
LATEST_TAG="$(echo "$TAGS" | tail --lines 1)"
if [ -z "$LATEST_TAG" ]; then
echo "Error: no release tags defined." >&2
exit 1
fi
git fetch "$SRC_REPO" "$LATEST_TAG"
git checkout FETCH_HEAD
CURRENT_REV="$(git rev-parse HEAD)"
STATE_DIR="/var/lib/auto-update"
[ -d "$STATE_DIR" ] || mkdir -p "$STATE_DIR"
if [ -e "$STATE_DIR/last-commit" ]; then
LAST_REV="$(cat "$STATE_DIR/last-commit")"
if [ "$CURRENT_REV" = "$LAST_REV" ]; then
echo "System is already up to date. Exiting." >&2
exit 0
fi
fi
echo -n "$CURRENT_REV" > "$STATE_DIR/last-commit"
nixos-rebuild switch --flake .#
popd
rm -rf "$TEMP_DIR"
'';
scriptArgs = "${configRepoSource}";
};
}
|
