nixos/modules/server/system.nix

28 lines
981 B
Nix
Raw Normal View History

2024-03-28 16:35:03 +01:00
{
config,
secrets,
...
}: {
2023-08-26 15:15:30 +02:00
# Automatically `nixos-rebuild switch` daily with the latest configuration
# from git. This overwrites any uncommitted changes in ~/nixos/, which is why
# it is only enabled on servers. Note that this requires updating flake.lock
# in the repository periodically (see Containerfile). Alternatively, at the
2023-08-26 15:15:30 +02:00
# cost of reproducability, add
# flags = [ "--recreate-lock-file" "--no-write-lock-file" ]
# to ignore the repository flake.lock and use the latest input versions.
system.autoUpgrade = {
enable = true;
flake = "git+https://git.caspervk.net/caspervk/nixos.git";
};
2024-03-28 16:35:03 +01:00
# The `nixos-secrets` flake input requires authentication
systemd.services.nixos-upgrade.environment.GIT_SSH_COMMAND = "ssh -i ${config.age.secrets.autoupgrade-deploy-key.path}";
age.secrets.autoupgrade-deploy-key = {
file = "${secrets}/secrets/autoupgrade-deploy-key.age";
mode = "400";
owner = "root";
group = "root";
};
2023-08-26 15:15:30 +02:00
}