View source for Automatic system upgrades

Automatic system upgrades can be used to upgrade a system regularly at a specific time. This can help to reduce the time period of applying important security patches to your running software but might also introduce some breakage in case an automatic upgrade fails. For automatic upgrades an automatic [[Garbage Collection|garbage collection]] is important to prevent full /boot and / partitions.

== Configuration ==

=== Channel-based systems (default) ===

Most NixOS installations use channels by default. If you're unsure which you're using, check with `nix-channel --list`. If that returns results, you're using channels.

For channel-based systems, use this configuration:

{{file|/etc/nixos/configuration.nix|nix|<nowiki>
system.autoUpgrade = {
  enable = true;
  flags = [
    "--print-build-logs"
  ];
  dates = "02:00";
  randomizedDelaySec = "45min";
  allowReboot = false;  # Set to true if you want automatic reboots
};
</nowiki>}}

<strong>Important:</strong> Do not use flake-specific flags with channel-based systems, as they will cause the upgrade to fail silently.

=== Flake-based systems ===

To enable unattended automatic system updates on a flake-enabled host, add following part to your configuration:

{{file|/etc/nixos/configuration.nix|nix|<nowiki>
system.autoUpgrade = {
  enable = true;
  flake = inputs.self.outPath;
  flags = [
    "--print-build-logs"
  ];
  dates = "02:00";
  randomizedDelaySec = "45min";
};
</nowiki>}}

== Monitoring ==

To see the status of the timer run

<syntaxhighlight lang="bash">
# systemctl status nixos-upgrade.timer
</syntaxhighlight>

The upgrade log can be printed with this command

<syntaxhighlight lang="bash">
# systemctl status nixos-upgrade.service
</syntaxhighlight>

To check if upgrades have been failing silently, examine the service logs:

<syntaxhighlight lang="bash">
# journalctl -u nixos-upgrade.service
</syntaxhighlight>

[[Category:NixOS]]