Automatic system upgrades: Difference between revisions

(One intermediate revision by the same user not shown)

Line 1:

Automatic system upgrades can be used to upgrade a system regularly at a specific time. This can help to reduce the time period of applying important security patches to your running software but might also introduce some breakage in case an automatic upgrade fails. For automatic upgrades an automatic [[Garbage Collection|garbage collection]] is important to prevent full /boot and / partitions.

Automatic system upgrades can be used to upgrade a system regularly at a specific time. This can help to reduce the time period of applying important security patches to your running software but might also introduce some breakage in case an automatic upgrade fails. For automatic upgrades an automatic [[Garbage Collection|garbage collection]] is important to prevent full <syntaxhighlight inline lang="bash">/boot</syntaxhighlight> and <syntaxhighlight inline lang="bash">/</syntaxhighlight> partitions.

== Configuration ==

Line 5:

=== Channel-based systems (default) ===

Most NixOS installations use channels by default. If you're unsure which you're using, check with `nix-channel --list`. If that returns results, you're using channels.

Most NixOS installations use channels by default. If you're unsure which you're using, check with <syntaxhighlight inline lang="bash">nix-channel --list</syntaxhighlight>. If that returns results, you're using channels.

For channel-based systems, use this configuration:

{{file|~~/etc/nixos/configuration~~.nix|nix|<nowiki>

{{file|auto-upgrade.nix|nix|<nowiki>

system.autoUpgrade = {

enable = true;

Line 27:

To enable unattended automatic system updates on a flake-enabled host, add following part to your configuration:

{{file|~~/etc/nixos/configuration~~.nix|nix|<nowiki>

{{file|auto-upgrade.nix|nix|<nowiki>

system.autoUpgrade = {

enable = true;

flake = ~~inputs.self.outPath~~;

flake = "/path/to/flake";

flags = [

"--print-build-logs"

"--commit-lock-file" # If you want to automatically commit the updated flake.lock

];

dates = "02:00";

Line 41:

Line 42:

== Monitoring ==

~~To see the status of the timer~~ run

Check that automatic system upgrades run successfully. Force an automatic system upgrade by running

# systemctl ~~status~~ nixos-upgrade~~.timer~~

# systemctl start nixos-upgrade

</syntaxhighlight>

~~The~~ upgrade log ~~can be printed~~ with ~~this command~~

Check the upgrade log with

Line 53:

Line 54:

</syntaxhighlight>

~~To check if upgrades have been failing silently~~, ~~examine~~ the ~~service logs:~~

Or, to see the full log

# journalctl -u nixos-upgrade.service

</syntaxhighlight>

To see the status of the upgrade timer run

# systemctl status nixos-upgrade.timer

</syntaxhighlight>

== Troubleshooting ==

=== Git "repository is not owned by current user" ===

The flake repository directory is not owned by <syntaxhighlight inline lang="bash">root</syntaxhighlight> (which <syntaxhighlight inline lang="bash">nixos-upgrade</syntaxhighlight> runs as). To fix this, add the following to <syntaxhighlight inline lang="bash">/root/.gitconfig</syntaxhighlight>:

{{file|/root/.gitconfig|gitconfig|<nowiki>

[safe]

directory = /path/to/flake

</nowiki>}}

[[Category:NixOS]]

@@ Line 1: / Line 1: @@
-Automatic system upgrades can be used to upgrade a system regularly at a specific time. This can help to reduce the time period of applying important security patches to your running software but might also introduce some breakage in case an automatic upgrade fails. For automatic upgrades an automatic [[Garbage Collection|garbage collection]] is important to prevent full /boot and / partitions.
+Automatic system upgrades can be used to upgrade a system regularly at a specific time. This can help to reduce the time period of applying important security patches to your running software but might also introduce some breakage in case an automatic upgrade fails. For automatic upgrades an automatic [[Garbage Collection|garbage collection]] is important to prevent full <syntaxhighlight inline lang="bash">/boot</syntaxhighlight> and <syntaxhighlight inline lang="bash">/</syntaxhighlight> partitions.
 == Configuration ==
@@ Line 5: / Line 5: @@
 === Channel-based systems (default) ===
-Most NixOS installations use channels by default. If you're unsure which you're using, check with `nix-channel --list`. If that returns results, you're using channels.
+Most NixOS installations use channels by default. If you're unsure which you're using, check with <syntaxhighlight inline lang="bash">nix-channel --list</syntaxhighlight>. If that returns results, you're using channels.
 For channel-based systems, use this configuration:
-{{file|/etc/nixos/configuration.nix|nix|<nowiki>
+{{file|auto-upgrade.nix|nix|<nowiki>
 system.autoUpgrade = {
    enable = true;
@@ Line 27: / Line 27: @@
 To enable unattended automatic system updates on a flake-enabled host, add following part to your configuration:
-{{file|/etc/nixos/configuration.nix|nix|<nowiki>
+{{file|auto-upgrade.nix|nix|<nowiki>
 system.autoUpgrade = {
    enable = true;
-   flake = inputs.self.outPath;
+   flake = "/path/to/flake";
    flags = [
      "--print-build-logs"
+    "--commit-lock-file"  # If you want to automatically commit the updated flake.lock
    ];
    dates = "02:00";
@@ Line 41: / Line 42: @@
 == Monitoring ==
-To see the status of the timer run
+Check that automatic system upgrades run successfully. Force an automatic system upgrade by running
 <syntaxhighlight lang="bash">
-# systemctl status nixos-upgrade.timer
+# systemctl start nixos-upgrade
 </syntaxhighlight>
-The upgrade log can be printed with this command
+Check the upgrade log with
 <syntaxhighlight lang="bash">
@@ Line 53: / Line 54: @@
 </syntaxhighlight>
-To check if upgrades have been failing silently, examine the service logs:
+Or, to see the full log
 <syntaxhighlight lang="bash">
 # journalctl -u nixos-upgrade.service
 </syntaxhighlight>
+To see the status of the upgrade timer run
+<syntaxhighlight lang="bash">
+# systemctl status nixos-upgrade.timer
+</syntaxhighlight>
+== Troubleshooting ==
+=== Git "repository is not owned by current user" ===
+The flake repository directory is not owned by <syntaxhighlight inline lang="bash">root</syntaxhighlight> (which <syntaxhighlight inline lang="bash">nixos-upgrade</syntaxhighlight> runs as). To fix this, add the following to <syntaxhighlight inline lang="bash">/root/.gitconfig</syntaxhighlight>:
+{{file|/root/.gitconfig|gitconfig|<nowiki>
+[safe]
+  directory = /path/to/flake
+</nowiki>}}
 [[Category:NixOS]]