Maintenance & Security: Auto Update #6

Document Dated : 30.01.2025

Maintenance & Security: Auto Update #6

• Updates are scheduled at a specific time (dates = "08:49";).
• It upgrades a Nix flake (flake = "github:wg-lux/luxnix";).
• Randomized delay (30 minutes) prevents all systems from updating at the exact same time.
• It allows reboots after updates (allowReboot = true), which matches the requirement for base_server, but not for gpu_client or gpu_server.

How to ensure:

Timer is active: systemctl status nixos-upgrade.timer
Upgrade is staged for next boot: nixos-rebuild list-generations
System Actually Rebooted: journalctl --grep="reboot"
Service status: systemctl status nixos-upgrade

How This Configuration Work in modules/nixos/luxnix/maintenance/auto-update/default.nix

• Defines default values for update behavior.
• Allows users to enable/disable updates (enable).
• Schedules update time (dates).
• Specifies how updates should happen (operation - boot or update).
• Defines the source for updates (via Nix flake)

Auto-Update Configuration

• Enables updates only if cfg.enable = true;.
• Uses a Nix flake (cfg.flake) for upgrades.
• Runs updates at a scheduled time (cfg.dates).
• Adds a randomized delay of 30 minutes (randomizedDelaySec = "30min";) to avoid simultaneous updates.
• Performs reboots after updates (allowReboot = true;).

In Base_server.yml, gpu_client.yml, gpu_server.yml (directory ansible/inventory/group_vars/):

Defines how each server updates.
Specifies update time (dates).
Controls whether updates require reboot (allowReboot). Ansible passes these values into NixOS configuration.

Steps to Implement automated system updates in NixOS, managed via Ansible, with different schedules for base server, GPU client, and GPU server.

Modify NixOS Configuration, Path: modules/nixos/luxnix/maintenance/audo-update/default.nix {

  config,  
  inputs,  
  pkgs,  
  lib,  
  ...  
}:

with lib;  
with lib.luxnix; let  
  cfg \= config.luxnix.maintenance.autoUpdates;

in {  
  options.luxnix.maintenance.autoUpdates \= with types; {  
	enable \= mkBoolOpt false "Enable or disable automated updates";  
	dates \= mkOption { type \= str; default \= "08:49"; description \= "Update time"; };  
	operation \= mkOption { type \= str; default \= "boot"; description \= "Update method"; };  
	flake \= mkOption { type \= str; default \= "github:wg-lux/luxnix"; description \= "Flake source"; };  
  };

  config \= mkIf cfg.enable {  
	system.autoUpgrade \= {  
  	enable \= cfg.enable;  
  	flake \= cfg.flake;  
  	flags \= \[ "-L" \];  
  	dates \= cfg.dates;  
  	operation \= cfg.operation;  
  	fixedRandomDelay \= true;  
  	randomizedDelaySec \= "30min";  
  	allowReboot \= true;  
	};  
  };  
}

Set Up Ansible Inventory Variables, Path: ansible/inventory/group_vars/

Base Server (base_server.yml):

group\_luxnix:  
  maintenance.autoUpdates.enable: "true"  
  maintenance.autoUpdates.flake: '"github:wg-lux/luxnix"'  
  maintenance.autoUpdates.dates: '"04:00"'

GPU Client (gpu_client.yml):

group\_luxnix:  
  maintenance.autoUpdates.enable: "true"  
  maintenance.autoUpdates.operation: '"switch"'  
  maintenance.autoUpdates.flake: '"github:wg-lux/luxnix"'  
  maintenance.autoUpdates.dates: '"09:00"'

GPU Server (gpu_server.yml):

group\_luxnix:  
  maintenance.autoUpdates.enable: "true"  
  maintenance.autoUpdates.operation: '"switch"'  
  maintenance.autoUpdates.flake: '"github:wg-lux/luxnix"'  
  maintenance.autoUpdates.dates: '"06:00"'

Run on NixOS server

sudo nixos-rebuild switch

or alternatively,

nhh

Run from Ansible controller

ansible-playbook \-i inventory/ playbook.yml

Now check if the Timer is activated

systemctl list-timers | grep nixos-upgrade