71 lines
2.1 KiB
Nix
71 lines
2.1 KiB
Nix
# Pull-based NixOS updates for hosts that can't be pushed to reliably.
|
|
# CI builds the system closure on muffin (which Harmonia serves), then
|
|
# records the output store path at /deploy/<hostname>. On boot this
|
|
# service fetches that path, pulls the closure from the binary cache,
|
|
# sets it as the boot profile, and reboots into it.
|
|
{ pkgs, hostname, ... }:
|
|
let
|
|
deploy-url = "https://nix-cache.sigkill.computer/deploy/${hostname}";
|
|
|
|
pull-update = pkgs.writeShellApplication {
|
|
name = "pull-update";
|
|
|
|
runtimeInputs = with pkgs; [
|
|
pkgs.curl
|
|
pkgs.coreutils
|
|
pkgs.nix
|
|
pkgs.systemd
|
|
pkgs.util-linux
|
|
];
|
|
|
|
text = ''
|
|
set -uo pipefail
|
|
|
|
# wait for actual connectivity, not just networkd "up"
|
|
for i in $(seq 1 30); do
|
|
if curl -sf --max-time 5 "${deploy-url}" >/dev/null; then
|
|
break
|
|
fi
|
|
echo "Waiting for network... ($i/30)"
|
|
sleep 2
|
|
done
|
|
|
|
STORE_PATH=$(curl -sf --max-time 30 "${deploy-url}" || true)
|
|
|
|
if [ -z "$STORE_PATH" ]; then
|
|
echo "Server unreachable or no deployment available, skipping"
|
|
exit 0
|
|
fi
|
|
|
|
CURRENT=$(readlink -f /nix/var/nix/profiles/system)
|
|
if [ "$CURRENT" = "$STORE_PATH" ]; then
|
|
echo "Already on latest configuration"
|
|
exit 0
|
|
fi
|
|
|
|
echo "Update available: $CURRENT -> $STORE_PATH"
|
|
|
|
nix-store -r "$STORE_PATH" || { echo "Failed to fetch closure"; exit 1; }
|
|
nix-env -p /nix/var/nix/profiles/system --set "$STORE_PATH" || { echo "Failed to set profile"; exit 1; }
|
|
"$STORE_PATH/bin/switch-to-configuration" boot || { echo "Failed to install boot entry"; exit 1; }
|
|
|
|
wall "System update installed. Rebooting in 10 seconds..."
|
|
sleep 10
|
|
systemctl reboot
|
|
'';
|
|
};
|
|
in
|
|
{
|
|
systemd.services.pull-update = {
|
|
description = "Pull latest NixOS configuration from binary cache";
|
|
after = [ "network-online.target" ];
|
|
wants = [ "network-online.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
restartIfChanged = false;
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
ExecStart = pull-update;
|
|
};
|
|
};
|
|
}
|