{ config, pkgs, lib, ... }: with lib; let cfg = config.services.naxos.selfUpdate; updateScript = pkgs.writeShellScriptBin "naxos-self-update" '' set -euo pipefail CONFIG_DIR="''${CONFIG_DIR:-/etc/naxos/repo}" LOG_FILE="/var/log/naxos-update.log" echo "[$(date -Iseconds)] Checking for NaxOS updates..." | tee -a "$LOG_FILE" if [ ! -d "$CONFIG_DIR/.git" ]; then echo "Configuration directory is not a git repository. Skipping." | tee -a "$LOG_FILE" exit 0 fi cd "$CONFIG_DIR" git fetch origin main LOCAL_HASH=$(git rev-parse HEAD) REMOTE_HASH=$(git rev-parse origin/main) if [ "$LOCAL_HASH" = "$REMOTE_HASH" ]; then echo "System is already up to date ($LOCAL_HASH)." | tee -a "$LOG_FILE" exit 0 fi echo "New updates detected ($LOCAL_HASH -> $REMOTE_HASH). Updating flake inputs and pulling..." | tee -a "$LOG_FILE" git merge origin/main --ff-only echo "Rebuilding and applying configuration..." | tee -a "$LOG_FILE" naxos-rebuild-safe ''; in { options.services.naxos.selfUpdate = { enable = mkEnableOption "NaxOS Automated Background Self-Update Service"; schedule = mkOption { type = types.str; default = "*-*-* 04:00:00"; # Daily at 4:00 AM description = "Systemd calendar expression for scheduled update checks."; }; channel = mkOption { type = types.enum [ "stable" "beta" "nightly" ]; default = "stable"; description = "Update release channel."; }; }; config = mkIf cfg.enable { environment.systemPackages = [ updateScript ]; systemd.services.naxos-self-update = { description = "NaxOS Self-Update Check & Apply"; path = [ pkgs.git pkgs.nix pkgs.systemd pkgs.bash ]; serviceConfig = { Type = "oneshot"; ExecStart = "${updateScript}/bin/naxos-self-update"; }; }; systemd.timers.naxos-self-update = { description = "NaxOS Scheduled Self-Update Timer"; wantedBy = [ "timers.target" ]; timerConfig = { OnCalendar = cfg.schedule; Persistent = true; RandomizedDelaySec = "1800"; # 30 min random jitter }; }; }; }