Merge pull request 'replace update script with something eval-less' (#135) from replace-update-script into main

Reviewed-on: #135

config/instance-20221213-1915.nix

@@ -124,7 +124,6 @@
   sops.age.sshKeyPaths = lib.mkForce ["/persist/ssh/ssh_host_ed25519_key"];
   services.bind.forwarders = lib.mkForce [];
   boot.loader.systemd-boot.configurationLimit = lib.mkForce 1;
-  system.autoUpgrade.allowReboot = true;
   services.tailscale.useRoutingFeatures = "server";
   services.postgresql.settings = {
     max_connections = 200;

config/nas.nix

@@ -173,7 +173,6 @@
   };
   services.tailscale.useRoutingFeatures = "both";
   hardware.sane.brscan4.enable = true;
-  system.autoUpgrade.allowReboot = true;
   services.kubo.settings.Addresses.API = lib.mkForce [
     "/ip4/0.0.0.0/tcp/5001"
     "/ip6/::/tcp/5001"

config/nix.nix

@@ -112,15 +112,45 @@
       ];
     distributedBuilds = true;
   };
-  system.autoUpgrade = {
-    enable = true;
-    flake = "git+https://git.chir.rs/darkkirb/nixos-config?ref=main";
-    flags = [
-      "--no-write-lock-file"
-      "-L" # print build logs
-    ];
-    dates = "hourly";
-    randomizedDelaySec = "1h";
-  };
   systemd.services.nix-daemon.environment.TMPDIR = "/build";
+  systemd.services.nixos-upgrade = {
+    description = "NixOS Upgrade";
+
+    restartIfChanged = false;
+    unitConfig.X-StopOnRemoval = false;
+
+    serviceConfig.Type = "oneshot";
+
+    path = with pkgs; [
+      coreutils
+      gnutar
+      xz.bin
+      gzip
+      gitMinimal
+      config.nix.package.out
+      config.programs.ssh.package
+      jq
+      curl
+    ];
+
+    script = lib.mkDefault "${../extra/update-reboot.sh}";
+    after = ["network-online.target"];
+    wants = ["network-online.target"];
+  };
+  systemd.timers.nixos-upgrade = {
+    timerConfig = {
+      OnBootSec = 300;
+      RandomizedDelaySec = 3600;
+      OnUnitActiveSecond = 3600;
+    };
+    requires = ["upload-hydra-results.service"];
+    wantedBy = ["multi-user.target"];
+  };
+  systemd.sockets.nixos-upgrade = {
+    socketConfig = {
+      Service = "nixos-upgrade.service";
+      BindIPv6Only = true;
+      ListenDatagram = "[::]:15553";
+    };
+  };
 }

config/nixos-8gb-fsn1-1.nix

@@ -206,4 +206,5 @@
   services.resolved.enable = false;
   services.bind.forwarders = lib.mkForce [];
   services.tailscale.useRoutingFeatures = "server";
+  systemd.services.nixos-upgrade.script = lib.mkForce "${../extra/update.sh}";
 }

config/nutty-noon.nix

@@ -119,5 +119,4 @@
   ];
   services.tailscale.useRoutingFeatures = "client";
   home-manager.users.darkkirb._module.args.withNSFW = lib.mkForce true;
-  system.autoUpgrade.allowReboot = true;
 }

config/thinkrac.nix

@@ -180,5 +180,4 @@
   hardware.bluetooth.enable = true;
   services.blueman.enable = true;
   services.tailscale.useRoutingFeatures = "client";
-  system.autoUpgrade.allowReboot = true;
 }

config/vf2.nix

@@ -119,7 +119,6 @@
     owner = "root";
     path = "/root/.ssh/id_ed25519";
   };
-  system.autoUpgrade.allowReboot = true;
   services.tailscale.useRoutingFeatures = "server";
   boot.kernel.sysctl."net.ipv4.conf.all.forwarding" = true;
   networking.useNetworkd = lib.mkForce false;

extra/update-reboot.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash curl jq nix
+
+set -ex
+
+builds=$(curl -H 'accept: application/json' https://hydra.int.chir.rs/jobset/nixos-config/nixos-config/evals | jq -r '.evals[0].builds[]')
+
+for build in $builds; do
+    doc=$(curl -H 'accept: application/json' https://hydra.int.chir.rs/build/$build)
+    system=$(echo $doc | jq -r '.system')
+    jobname=$(echo $doc | jq -r '.job')
+    if [ "$jobname" = "$(hostname).$system" ]; then
+        drvname=$(echo $doc | jq -r '.drvpath')
+        output=$(nix-store -r $drvname)
+        $output/bin/switch-to-configuration boot
+        booted="$(readlink /run/booted-system/{initrd,kernel,kernel-modules})"
+        built="$(readlink /nix/var/nix/profiles/system/{initrd,kernel,kernel-modules})"
+        if [ "${booted}" = "${built}" ]; then
+            $output/bin/switch-to-configuration switch
+        else
+            shutdown -r +1
+        fi
+        exit
+    fi
+done

extra/update.sh

@@ -0,0 +1,18 @@
+#!/usr/bin/env nix-shell
+#!nix-shell -i bash -p bash curl jq nix
+
+set -ex
+
+builds=$(curl -H 'accept: application/json' https://hydra.int.chir.rs/jobset/nixos-config/nixos-config/evals | jq -r '.evals[0].builds[]')
+
+for build in $builds; do
+    doc=$(curl -H 'accept: application/json' https://hydra.int.chir.rs/build/$build)
+    system=$(echo $doc | jq -r '.system')
+    jobname=$(echo $doc | jq -r '.job')
+    if [ "$jobname" = "$(hostname).$system" ]; then
+        drvname=$(echo $doc | jq -r '.drvpath')
+        output=$(nix-store -r $drvname)
+        $output/bin/switch-to-configuration switch
+        exit
+    fi
+done