]> git.scottworley.com Git - auto-upgrade-with-pinch/blame - modules/auto-upgrade.nix
Declare that there are no loose packages here
[auto-upgrade-with-pinch] / modules / auto-upgrade.nix
CommitLineData
901670f5
SW
1{ config, lib, pkgs, ... }:
2with lib;
364c110c
SW
3let
4 cfg = config.system.autoUpgradeWithPinch;
f1a53b29 5 pull-repo-script =
4cbd961f
SW
6 pkgs.writeShellScript "pull-repo" ''
7 set -eo pipefail
8
f1a53b29
SW
9 path=$1
10 config=$2
4cbd961f 11
f1a53b29
SW
12 prop() {
13 ${pkgs.jq}/bin/jq -r ".$1" <<< "$config"
14 }
15
16 echo Pulling in "$path" >&2
17
18 if [[ ! -e "$path" ]];then
4cbd961f
SW
19 d=$(mktemp -d)
20 ${pkgs.git}/bin/git init "$d"
f1a53b29
SW
21 ${pkgs.git}/bin/git -C "$d" checkout -b "$(prop localBranch)"
22 ${pkgs.git}/bin/git -C "$d" remote add "$(prop remoteName)" "$(prop url)"
23 ${pkgs.git}/bin/git -C "$d" branch -u "$(prop remoteBranch)"
24 mkdir -p "$(${pkgs.coreutils}/bin/dirname "$path")"
25 mv "$d" "$path"
4cbd961f
SW
26 fi
27
f1a53b29
SW
28 cd "$path"
29
30 if [[ "$(${pkgs.git}/bin/git remote get-url "$(prop remoteName)")" != "$(prop url)" ]]; then
31 echo Expected git remote "$(prop remoteName)" to point at "$(prop url)" \
32 but it points at "$(${pkgs.git}/bin/git remote get-url "$(prop remoteName)")" >&2
33 case "$(prop onRemoteURLMismatch)" in
34 abort) exit 1;;
35 update) echo Updating it >&2
36 ${pkgs.git}/bin/git -C "$d" remote set-url "$(prop remoteName)" "$(prop url)";;
37 esac
4cbd961f
SW
38 fi
39
f1a53b29 40 ${pkgs.git}/bin/git fetch "$(prop remoteName)" "$(prop remoteBranch)"
4cbd961f 41
f1a53b29 42 if [[ "$(${pkgs.git}/bin/git rev-parse --abbrev-ref HEAD)" != "$(prop localBranch)" ]];then
4cbd961f
SW
43 echo Could not merge because currently-checked-out \
44 \""$(${pkgs.git}/bin/git rev-parse --abbrev-ref HEAD)"\" is not \
f1a53b29
SW
45 \""$(prop localBranch)"\"
46 case "$(prop onBranchMismatch)" in
47 abort) exit 1;;
48 continue) exit 0;;
49 esac
4cbd961f
SW
50 fi
51
f1a53b29
SW
52 if [[ "$(prop requireSignature)" == true ]]; then
53 ${pkgs.polite-merge}/bin/polite-merge \
5ea02587 54 -c gpg.program=${escapeShellArg (pkgs.keyedgpg cfg.signingKeys)} \
f1a53b29
SW
55 merge --ff-only --verify-signatures
56 else
57 ${pkgs.polite-merge}/bin/polite-merge merge --ff-only
58 fi
4cbd961f 59 '';
9dbfef33 60
364c110c 61 auto-upgrade-script = pkgs.writeShellScript "auto-upgrade" ''
2b58720b 62 ${pkgs.utillinux}/bin/flock /run/auto-upgrade-with-pinch ${
364c110c 63 pkgs.writeShellScript "auto-upgrade-with-lock-held" ''
4cbd961f 64 set -eo pipefail
eb0fa99c 65
f1a53b29
SW
66 dry_run=false
67 pinch_args=()
68 if [[ "$1" == --dry-run ]];then
69 dry_run=true
70 pinch_args=( --dry-run )
71 fi
72
73 hydrate() {
74 if "$dry_run";then
75 echo "Would run: $*"
76 else
77 "$@"
78 fi
79 }
80
81 die() {
82 echo "$*" >&2
83 exit 1
84 }
85
eb0fa99c 86 in_tmpdir() {
4cbd961f 87 d=$(${pkgs.coreutils}/bin/mktemp -d)
eb0fa99c
SW
88 pushd "$d"
89 "$@"
90 popd
4cbd961f 91 ${pkgs.coreutils}/bin/rm -r "$d"
eb0fa99c
SW
92 }
93
f1a53b29
SW
94 ${optionalString (cfg.upgradeConfigOwnershipPolicy != "any") (''
95 verify_ownership() {
96 if [[ "$1" != /* ]];then
97 die "Unexpected relative path: $1"
98 fi
99 if [[ "$1" != / ]];then
100 verify_ownership "$(${pkgs.coreutils}/bin/dirname "$1")"
101 fi
102 if [[ ! -e "$1" ]];then
103 die "Could not find upgrade config: $1 does not exist"
104 fi
105 if [[ -h "$1" ]];then
106 verify_ownership "$(
107 ${pkgs.coreutils}/bin/realpath --no-symlinks \
108 "$(${pkgs.coreutils}/bin/dirname "$1")/$(${pkgs.coreutils}/bin/readlink "$1")"
109 )"
110 fi
111 perms="$(${pkgs.findutils}/bin/find "$1" -maxdepth 0 -printf "%M")"
112 if [[ "$perms" == d*t ]];then
113 die "Will not use upgrade config in sticky directory $1"
114 fi
115 owner=$(${pkgs.findutils}/bin/find "$1" -maxdepth 0 -printf "%u")
116 if [[ "$owner" != root ]];then
117 die "Will not use upgrade config not owned by root in $1"
118 fi
119 if [[ "$perms" == l* ]];then
120 return 0 # Root-owned symlinks are fine
121 fi
122 if [[ "$perms" == *w? ]];then
123 die "Will not use world-writable upgrade config in $1"
124 fi
125 ${
126 {
127 root = ''
128 if [[ "$perms" == *w???? ]];then
129 die "Will not use group-writable upgrade config in $1"
130 fi
131 '';
132 wheel = ''
133 if [[ "$perms" == *w???? ]];then
134 group=$(${pkgs.findutils}/bin/find "$1" -maxdepth 0 -printf "%g")
135 if [[ "$group" != wheel ]];then
136 die "Will not use non-wheel-group group-writable upgrade config in $1"
137 fi
138 fi
139 '';
140 }."${cfg.upgradeConfigOwnershipPolicy}"
141 }
142 }
143 ''
144 + concatMapStringsSep "\n" (f: "verify_ownership ${escapeShellArg f}")
145 cfg.upgradeConfig)}
146
147 config=$(${pkgs.nix}/bin/nix eval --json -f ${../upgrade-config.nix} \
148 --arg upgradeConfig ${
149 escapeShellArg ("["
150 + lib.concatMapStringsSep " " lib.strings.escapeNixString
151 cfg.upgradeConfig + "]")
152 } config)
153
154 config_query() {
155 ${pkgs.jq}/bin/jq -r "$@" <<< "$config"
156 }
157
158 repo_query() {
159 config_query --arg path "$1" ".repos[\$ARGS.named.path]$2"
160 }
161
162 userenv_query() {
163 config_query --arg user "$1" ".userEnvironments[\$ARGS.named.user]$2"
164 }
165
9dbfef33 166 # Pull updates
f1a53b29
SW
167 while read path;do
168 hydrate /run/wrappers/bin/sudo -u "$(repo_query "$path" .user)" \
169 ${pull-repo-script} "$path" "$(repo_query "$path" "")"
170 done < <( config_query '.repos | keys []' )
364c110c 171
fae44c38 172 # Update channels
f1a53b29 173 config_query '.pinchFiles[]' | ${pkgs.findutils}/bin/xargs --no-run-if-empty --delimiter=\\n ${pkgs.pinch}/bin/pinch update "''${pinch_args[@]}"
fae44c38 174
eb0fa99c 175 # Build
f1a53b29
SW
176 in_tmpdir hydrate ${config.system.build.nixos-rebuild}/bin/nixos-rebuild build
177 while read user;do
178 hydrate /run/wrappers/bin/sudo -u "$user" \
179 ${pkgs.nix}/bin/nix-build --no-out-link '<nixpkgs>' -A "$(userenv_query "$user" .package)"
180 done < <( config_query '.userEnvironments | keys []' )
eb0fa99c
SW
181
182 # Install
f1a53b29
SW
183 hydrate ${config.system.build.nixos-rebuild}/bin/nixos-rebuild switch
184 while read user;do
185 remove_arg=-r
186 if [[ "$(userenv_query "$user" .otherPackagesAction)" == keep ]];then
187 remove_arg=
188 fi
189 hydrate /run/wrappers/bin/sudo -u "$user" \
190 ${pkgs.nix}/bin/nix-env -f '<nixpkgs>' $remove_arg -iA "$(userenv_query "$user" .package)"
191 done < <( config_query '.userEnvironments | keys []' )
364c110c
SW
192 ''
193 }
194 '';
f1a53b29 195
901670f5
SW
196in {
197 options = {
198 system.autoUpgradeWithPinch = {
199
200 enable = mkOption {
201 type = types.bool;
202 default = false;
203 description = ''
204 Whether to periodically upgrade NixOS to the latest version.
205 Presumes that /etc/nixos is a git repo with a remote and
206 contains a pinch file called "channels".
207 '';
208 };
209
210 dates = mkOption {
211 default = "04:40";
212 type = types.str;
213 description = ''
214 Specification (in the format described by
215 <citerefentry><refentrytitle>systemd.time</refentrytitle>
216 <manvolnum>7</manvolnum></citerefentry>) of the time at
217 which the update will occur.
218 '';
219 };
d8537205 220
5ea02587
SW
221 signingKeys = mkOption {
222 type = types.listOf types.path;
223 description = ''
224 Files containing GPG keys that are authorized to sign updates.
225 Updates are only merged if the commit at the tip of the remote
226 ref is signed with one of these keys.
227 '';
228 };
229
f1a53b29
SW
230 upgradeConfig = mkOption {
231 type = types.listOf types.path;
d8537205 232 description = ''
f1a53b29
SW
233 Configuration files that specify what git repo paths to pull, what
234 pinch files to update from, and what user environments to update.
235 These are specified in separate configuration files processed at
236 update time so that changes to this configuration take effect in
237 the same update cycle.
d8537205 238 '';
4cbd961f 239 };
eb0fa99c 240
f1a53b29
SW
241 upgradeConfigOwnershipPolicy = mkOption {
242 type = types.enum [ "root" "wheel" "any" ];
243 default = "root";
4cbd961f 244 description = ''
f1a53b29
SW
245 Verify ownership of upgrade config files before using them for
246 system upgrades.
eb0fa99c 247
f1a53b29
SW
248 root = Config must be writable only by root.
249 wheel = Config must be writable only by root and wheel.
250 any = No checks. Not recommended.
4cbd961f 251 '';
eb0fa99c 252 };
901670f5
SW
253 };
254 };
255
256 config = lib.mkIf cfg.enable {
364c110c
SW
257
258 security.sudo.extraRules = lib.mkAfter [{
259 groups = [ "users" ];
260 commands = [{
261 command = "${auto-upgrade-script}";
262 options = [ "NOPASSWD" "NOSETENV" ];
263 }];
264 }];
265 # NOSETENV above still allows through ~17 vars, including PATH. Block those
266 # as well:
267 security.sudo.extraConfig = ''
268 Defaults!${auto-upgrade-script} !env_check
269 Defaults!${auto-upgrade-script} !env_keep
270 '';
271
d8537205 272 nixpkgs.overlays = [
f1a53b29 273 (import ../overlays/keyedgpg.nix)
d8537205 274 (import ../overlays/pinch.nix)
5048e8ce 275 (import ../overlays/polite-merge.nix)
5aaf4680
SW
276 (self: super: {
277 auto-upgrade = super.writeShellScriptBin "auto-upgrade" ''
4acf153c 278 /run/wrappers/bin/sudo ${auto-upgrade-script}
5aaf4680
SW
279 '';
280 })
d8537205 281 ];
5aaf4680
SW
282
283 environment.systemPackages = [ pkgs.auto-upgrade ];
284
901670f5
SW
285 systemd.services.nixos-upgrade = {
286 description = "NixOS Upgrade";
287 restartIfChanged = false;
288 unitConfig.X-StopOnRemoval = false;
289 serviceConfig.Type = "oneshot";
290 environment = config.nix.envVars // {
291 inherit (config.environment.sessionVariables) NIX_PATH;
292 HOME = "/root";
293 } // config.networking.proxy.envVars;
294
295 path = with pkgs; [
296 config.nix.package.out
297 coreutils
298 git
299 gitMinimal
300 gnutar
301 gzip
901670f5
SW
302 xz.bin
303 ];
304
305 script = ''
4cbd961f 306 set -eo pipefail
8569b965
SW
307
308 # Chill for awhile before applying updates. If applying an update
309 # badly breaks things, we want a window in which an operator can
310 # intervene either to fix the problem or disable automatic updates.
311 sleep 2h
312
364c110c 313 ${auto-upgrade-script}
901670f5
SW
314 '';
315
316 startAt = cfg.dates;
317 };
318 };
319}