nix/module/common/AutoUpdateSigned.nix

42 lines
1.1 KiB
Nix
Raw Normal View History

# System automatic updates.
# This is a systemd service that pulls updates every hour.
# Unlike system.autoUpgrade, this script also verifies my git signature
# to prevent unathorized changes to hosts.
{ const, pkgs, lib, secret, util, ... }: {
systemd.services.autoupdate = util.mkStaticSystemdService {
enable = true;
description = "Signed system auto-update.";
serviceConfig.Type = "oneshot";
path = with pkgs; [
bash
git
gnumake
nixos-rebuild
openssh
];
script = ''
pushd /tmp
rm -rf ./nixos
${lib.getExe pkgs.git} clone --depth=1 --single-branch --branch=main ${const.url} ./nixos
pushd ./nixos
${lib.getExe pkgs.git} verify-commit HEAD || {
echo "Verification failed."
exit 1
};
${lib.getExe pkgs.gnumake} switch
'';
2024-05-04 22:22:59 +03:00
after = [ "network-online.target" ];
wants = [ "network-online.target" ];
};
systemd.timers.autoupdate = {
timerConfig = {
OnCalendar = "hourly";
Persistent = true;
Unit = "autoupdate.service";
2024-05-04 22:22:59 +03:00
# RandomizedDelaySec = 60;
};
wantedBy = [ "timers.target" ];
};
}