This repository has no description
2configs.autoupdate: compare against deploy time instead of source lastModified
author
lassulus
date
(Sep 23, 2026, 5:26 PM CEST)
commit
0770db2f
0770db2f43837b3fbe030ef93d385afe7990ee31
parent
4aad52a9
4aad52a9ccc3cd95c048396479301ec0994adc0a
+16
-14
+16
-14
2configs/autoupdate.nix
+16
-14
2configs/autoupdate.nix
···
2
2
config,
3
3
lib,
4
4
pkgs,
5
-
self,
6
5
...
7
6
}:
8
7
let
9
8
flake = "github:lassulus/superconfig";
10
9
11
-
# Timestamp of the flake revision this system was built from, baked into the
12
-
# closure so the running system knows how old its own source is.
13
-
stampFile = "/run/current-system/source-lastModified";
14
-
15
10
# system.autoUpgrade switches to whatever the flake currently evaluates to,
16
11
# forwards or backwards. A machine deployed from an unpushed local checkout
17
12
# therefore gets reverted to the older remote HEAD on the next timer run.
18
-
# Refuse to move backwards in time.
13
+
# Refuse to move backwards in time: only upgrade to a revision committed
14
+
# after the running system was deployed. The deploy time is when its profile
15
+
# generation was created (/run/current-system's mtime if no generation points
16
+
# at it); the source's own lastModified is no use, since `clan machines
17
+
# update` builds from a path: flake, which has none.
19
18
guard = pkgs.writeShellApplication {
20
19
name = "autoupgrade-forward-only";
21
20
runtimeInputs = [
···
24
23
pkgs.jq
25
24
];
26
25
text = ''
27
-
stamp=''${1:-${stampFile}}
28
-
current=$(cat "$stamp" 2>/dev/null || echo 0)
26
+
system=$(readlink -f /run/current-system)
27
+
deployed=0
28
+
for link in /nix/var/nix/profiles/system-*-link; do
29
+
if [ "$(readlink -f "$link")" = "$system" ]; then
30
+
created=$(stat -c %Y "$link")
31
+
if [ "$created" -gt "$deployed" ]; then deployed=$created; fi
32
+
fi
33
+
done
34
+
if [ "$deployed" -eq 0 ]; then deployed=$(stat -c %Y /run/current-system); fi
29
35
if ! meta=$(nix flake metadata --refresh --json ${lib.escapeShellArg flake}); then
30
36
echo "autoupgrade: cannot reach ${flake}; letting nixos-upgrade report the error"
31
37
exit 0
32
38
fi
33
39
remote=$(jq -r '.lastModified // 0' <<<"$meta")
34
-
if [ "$remote" -gt "$current" ]; then
40
+
if [ "$remote" -gt "$deployed" ]; then
35
41
exit 0
36
42
fi
37
-
echo "autoupgrade: ${flake} is at $remote, running system is at $current; skipping"
43
+
echo "autoupgrade: ${flake} is at $remote, running system was deployed at $deployed; skipping"
38
44
exit 1
39
45
'';
40
46
};
···
45
51
inherit flake;
46
52
randomizedDelaySec = "6h";
47
53
};
48
-
49
-
system.extraSystemBuilderCmds = ''
50
-
echo -n ${toString (self.lastModified or 0)} > $out/source-lastModified
51
-
'';
52
54
53
55
systemd.services.nixos-upgrade.serviceConfig.ExecCondition = lib.getExe guard;
54
56
}