config/modules/services/updaterbot/default.nix

82 lines
2.4 KiB
Nix
Raw Normal View History

2023-07-28 14:20:50 +03:00
{
config,
lib,
2023-07-28 15:37:19 +03:00
pkgs,
2023-07-28 14:20:50 +03:00
...
}: {
options.mj.services.updaterbot = with lib.types; {
2023-07-28 16:09:41 +03:00
enableMaster = lib.mkEnableOption "Enable system updater orchestrator";
enableDeployer = lib.mkEnableOption "Enable system updater deployer";
2023-07-28 14:20:50 +03:00
deployDerivations = lib.mkOption {type = listOf str;};
uidgid = lib.mkOption {type = int;};
repo = lib.mkOption {type = str;};
};
2023-07-28 16:09:41 +03:00
config = lib.mkIf config.mj.services.updaterbot.enableMaster {
2023-07-28 14:20:50 +03:00
users = {
users = {
# TODO: git config --global user.email updaterbot@jakstys.lt
# TODO: ssh-keygen -t ed25519
updaterbot = {
description = "Dear Updaterbot";
home = "/var/lib/updaterbot";
useDefaultShell = true;
group = "updaterbot";
isSystemUser = true;
createHome = true;
uid = config.mj.services.updaterbot.uidgid;
};
};
groups = {
updaterbot.gid = config.mj.services.updaterbot.uidgid;
};
};
2023-07-28 15:37:19 +03:00
systemd.services.updaterbot = {
description = "Update all known systems";
preStart = ''
if [[ -f .ssh/id_ed25519 ]]; then exit; fi
${pkgs.openssh}/bin/ssh-keygen -N "" -t ed25519 -f .ssh/id_ed25519
'';
serviceConfig = {
Type = "oneshot";
User = "updaterbot";
WorkingDirectory = config.users.users.updaterbot.home;
};
script = let
deployDerivations = builtins.concatStringsSep " " config.mj.services.updaterbot.deployDerivations;
in ''
set -x
export GIT_SSH_COMMAND="${pkgs.openssh}/bin/ssh -i $HOME/.ssh/id_ed25519"
if [[ ! -d config ]]; then
${pkgs.git}/bin/git clone ${config.mj.services.updaterbot.repo} config
cd config
else
cd config
${pkgs.git}/bin/git fetch origin
${pkgs.git}/bin/git reset --hard origin/main
fi
2023-07-28 15:49:51 +03:00
export PATH=$PATH:${pkgs.git}/bin:${pkgs.nix}/bin
2023-07-28 15:37:19 +03:00
${pkgs.nix}/bin/nix flake update --accept-flake-config --commit-lock-file
${pkgs.git}/bin/git push origin main
2023-07-28 15:49:51 +03:00
export PATH=$PATH:${pkgs.openssh}/bin
exec ${pkgs.nix}/bin/nix run .#deploy-rs -- ${deployDerivations}
2023-07-28 15:37:19 +03:00
'';
};
2023-07-28 15:49:51 +03:00
#systemd.timers.updaterbot = {
# description = "updaterbot timer";
# wantedBy = ["timers.target"];
# timerConfig.OnCalendar = "";
#};
2023-07-28 15:37:19 +03:00
mj.base.unitstatus.units = ["updaterbot"];
2023-07-28 14:20:50 +03:00
nix.settings.trusted-users = ["updaterbot"];
};
}