This repository has no description
1.6 kB
54 lines
1{
2 config,
3 lib,
4 pkgs,
5 self,
6 ...
7}:
8let
9 flake = "github:lassulus/superconfig";
10
11 # Timestamp of the flake revision this system was built from, baked into the
12 # closure so the running system knows how old its own source is.
13 stampFile = "/run/current-system/source-lastModified";
14
15 # system.autoUpgrade switches to whatever the flake currently evaluates to,
16 # forwards or backwards. A machine deployed from an unpushed local checkout
17 # therefore gets reverted to the older remote HEAD on the next timer run.
18 # Refuse to move backwards in time.
19 guard = pkgs.writeShellApplication {
20 name = "autoupgrade-forward-only";
21 runtimeInputs = [
22 config.nix.package
23 pkgs.coreutils
24 pkgs.jq
25 ];
26 text = ''
27 stamp=''${1:-${stampFile}}
28 current=$(cat "$stamp" 2>/dev/null || echo 0)
29 if ! meta=$(nix flake metadata --refresh --json ${lib.escapeShellArg flake}); then
30 echo "autoupgrade: cannot reach ${flake}; letting nixos-upgrade report the error"
31 exit 0
32 fi
33 remote=$(jq -r '.lastModified // 0' <<<"$meta")
34 if [ "$remote" -gt "$current" ]; then
35 exit 0
36 fi
37 echo "autoupgrade: ${flake} is at $remote, running system is at $current; skipping"
38 exit 1
39 '';
40 };
41in
42{
43 system.autoUpgrade = {
44 enable = true;
45 inherit flake;
46 randomizedDelaySec = "6h";
47 };
48
49 system.extraSystemBuilderCmds = ''
50 echo -n ${toString (self.lastModified or 0)} > $out/source-lastModified
51 '';
52
53 systemd.services.nixos-upgrade.serviceConfig.ExecCondition = lib.getExe guard;
54}