Add the option to use `nix-env --set` for user profiles

[auto-upgrade-with-pinch] / modules / auto-upgrade.nix

diff --git a/modules/auto-upgrade.nix b/modules/auto-upgrade.nix
index c52f0bce10ab6fa5ce6ba0c47114692290ed84b5..918b4a96c4f0a0d79d5c04049fd19f0bcb5d6883 100644 (file)
--- a/modules/auto-upgrade.nix
+++ b/modules/auto-upgrade.nix
@@ -197,15 +197,19 @@ let
       sync
 
       # Install
-      hydrate ${config.system.build.nixos-rebuild}/bin/nixos-rebuild switch
+      hydrate ${config.system.build.nixos-rebuild}/bin/nixos-rebuild ${cfg.operation}
       sync
       while read user;do
-        remove_arg=-r
-        if [[ "$(userenv_query "$user" .otherPackagesAction)" == keep ]];then
-          remove_arg=
-        fi
+        configured_action=$(userenv_query "$user" .otherPackagesAction)
+        action=
+        case "$configured_action" in
+          keep)       action=-i;;
+          remove)     action=-ir;;
+          set-remove) action=--set;;
+          *)          die "Unexpected otherPackagesAction $configured_action for user $user"
+        esac
         hydrate /run/wrappers/bin/sudo -u "$user" \
-          ${pkgs.nix}/bin/nix-env -f '<nixpkgs>' $remove_arg -iA "$(userenv_query "$user" .package)"
+          ${pkgs.nix}/bin/nix-env -f '<nixpkgs>' "$action" -A "$(userenv_query "$user" .package)"
         sync
       done < <( config_query '.userEnvironments | keys []' )
     ''}
@@ -237,6 +241,20 @@ in
         '';
       };
 
+      operation = lib.mkOption {
+        type = lib.types.enum [
+          "switch"
+          "boot"
+        ];
+        default = "switch";
+        example = "boot";
+        description = ''
+          Whether to run
+          `nixos-rebuild switch --upgrade` or run
+          `nixos-rebuild boot --upgrade`
+        '';
+      };
+
       signingKeys = mkOption {
         type = types.listOf types.path;
         description = ''
@@ -281,6 +299,7 @@ in
     security.sudo.extraRules = lib.mkAfter [
       {
         groups = [ "users" ];
+        runAs = "root";
         commands = [
           {
             command = "${auto-upgrade-script}";