nix/module/common/AutoUpdateSigned.nix

41 lines
944 B
Nix
Raw Normal View History

{ const, pkgs, lib, secret, ... }: {
systemd.services.autoupdate = {
enable = true;
description = "Signed system auto-update.";
restartIfChanged = false;
serviceConfig.Type = "oneshot";
stopIfChanged = false;
unitConfig.X-StopOnRemoval = false;
path = with pkgs; [
bash
git
gnumake
nixos-rebuild
openssh
];
script = ''
pushd /tmp
rm -rf ./nixos
${lib.getExe pkgs.git} clone --depth=1 --single-branch --branch=main ${const.url} ./nixos
pushd ./nixos
${lib.getExe pkgs.git} verify-commit HEAD || {
echo "Verification failed."
exit 1
};
${lib.getExe pkgs.gnumake} switch
'';
2024-05-04 22:22:59 +03:00
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
};
systemd.timers.autoupdate = {
timerConfig = {
OnCalendar = "hourly";
Persistent = true;
Unit = "autoupdate.service";
2024-05-04 22:22:59 +03:00
# RandomizedDelaySec = 60;
};
wantedBy = [ "timers.target" ];
};
}