frajul-auto-upgrade: restore flake.lock if update failed

This makes builds not fail when my own binary cache is offline for some reason

flake.lock

@@ -58,11 +58,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750903843,
-        "narHash": "sha256-Ng9+f0H5/dW+mq/XOKvB9uwvGbsuiiO6HrPdAcVglCs=",
+        "lastModified": 1753140376,
+        "narHash": "sha256-7lrVrE0jSvZHrxEzvnfHFE/Wkk9DDqb+mYCodI5uuB8=",
         "owner": "nix-community",
         "repo": "disko",
-        "rev": "83c4da299c1d7d300f8c6fd3a72ac46cb0d59aae",
+        "rev": "545aba02960caa78a31bd9a8709a0ad4b6320a5c",
         "type": "github"
       },
       "original": {
@@ -111,11 +111,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749398372,
-        "narHash": "sha256-tYBdgS56eXYaWVW3fsnPQ/nFlgWi/Z2Ymhyu21zVM98=",
+        "lastModified": 1753121425,
+        "narHash": "sha256-TVcTNvOeWWk1DXljFxVRp+E0tzG1LhrVjOGGoMHuXio=",
         "owner": "hercules-ci",
         "repo": "flake-parts",
-        "rev": "9305fe4e5c2a6fcf5ba6a3ff155720fbe4076569",
+        "rev": "644e0fc48951a860279da645ba77fe4a6e814c5e",
         "type": "github"
       },
       "original": {
@@ -143,21 +143,6 @@
       }
     },
     "flake-utils_2": {
-      "locked": {
-        "lastModified": 1659877975,
-        "narHash": "sha256-zllb8aq3YO3h8B/U0/J1WBgAL8EX5yWf5pMj3G0NAmc=",
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "rev": "c0e246b9b83f637f4681389ecabcb2681b4f3af0",
-        "type": "github"
-      },
-      "original": {
-        "owner": "numtide",
-        "repo": "flake-utils",
-        "type": "github"
-      }
-    },
-    "flake-utils_3": {
       "inputs": {
         "systems": "systems_3"
       },
@@ -175,9 +160,27 @@
         "type": "github"
       }
     },
+    "flake-utils_3": {
+      "inputs": {
+        "systems": "systems_4"
+      },
+      "locked": {
+        "lastModified": 1731533236,
+        "narHash": "sha256-l0KFg5HjrsfsO/JpG+r7fRrqm12kzFHyUHqHCVpMMbI=",
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "rev": "11707dc2f618dd54ca8739b309ec4fc024de578b",
+        "type": "github"
+      },
+      "original": {
+        "owner": "numtide",
+        "repo": "flake-utils",
+        "type": "github"
+      }
+    },
     "flake-utils_4": {
       "inputs": {
-        "systems": "systems_5"
+        "systems": "systems_6"
       },
       "locked": {
         "lastModified": 1731533236,
@@ -200,11 +203,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751239699,
-        "narHash": "sha256-zA1uUdAq3c26fHm26xMWMuF5COhI18EzaH7az/P2OWM=",
+        "lastModified": 1753470191,
+        "narHash": "sha256-hOUWU5L62G9sm8NxdiLWlLIJZz9H52VuFiDllHdwmVA=",
         "owner": "nix-community",
         "repo": "home-manager",
-        "rev": "f6deff178cc4d6049d30785dbfc831e6c6e3a219",
+        "rev": "a1817d1c0e5eabe7dfdfe4caa46c94d9d8f3fdb6",
         "type": "github"
       },
       "original": {
@@ -324,11 +327,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1713543440,
-        "narHash": "sha256-lnzZQYG0+EXl/6NkGpyIz+FEOc/DSEG57AP1VsdeNrM=",
+        "lastModified": 1752054764,
+        "narHash": "sha256-Ob/HuUhANoDs+nvYqyTKrkcPXf4ZgXoqMTQoCK0RFgQ=",
         "owner": "nix-community",
         "repo": "nixgl",
-        "rev": "310f8e49a149e4c9ea52f1adf70cdc768ec53f8a",
+        "rev": "a8e1ce7d49a149ed70df676785b07f63288f53c5",
         "type": "github"
       },
       "original": {
@@ -345,11 +348,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1751122911,
-        "narHash": "sha256-XVVKlxAmRe+DlkznExlv4V0f/W/qYkCBL3Tp+5ycoB0=",
+        "lastModified": 1753455814,
+        "narHash": "sha256-c78Dm4hxF9z1grjKbkKPvkOccIIxIl+optGRL0UDnf4=",
         "owner": "doronbehar",
         "repo": "nix-matlab",
-        "rev": "56437a6fe605f8a4bad0798f2b865d5851b8efca",
+        "rev": "550d8ad0c21c63991e873bf4dcfe3d69adc1a2f1",
         "type": "gitlab"
       },
       "original": {
@@ -360,11 +363,11 @@
     },
     "nixos-hardware": {
       "locked": {
-        "lastModified": 1750837715,
-        "narHash": "sha256-2m1ceZjbmgrJCZ2PuQZaK4in3gcg3o6rZ7WK6dr5vAA=",
+        "lastModified": 1753122741,
+        "narHash": "sha256-nFxE8lk9JvGelxClCmwuJYftbHqwnc01dRN4DVLUroM=",
         "owner": "nixos",
         "repo": "nixos-hardware",
-        "rev": "98236410ea0fe204d0447149537a924fb71a6d4f",
+        "rev": "cc66fddc6cb04ab479a1bb062f4d4da27c936a22",
         "type": "github"
       },
       "original": {
@@ -406,11 +409,11 @@
     },
     "nixpkgs-stable": {
       "locked": {
-        "lastModified": 1751048012,
-        "narHash": "sha256-MYbotu4UjWpTsq01wglhN5xDRfZYLFtNk7SBY0BcjkU=",
+        "lastModified": 1751274312,
+        "narHash": "sha256-/bVBlRpECLVzjV19t5KMdMFWSwKLtb5RyXdjz3LJT+g=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "a684c58d46ebbede49f280b653b9e56100aa3877",
+        "rev": "50ab793786d9de88ee30ec4e4c24fb4236fc2674",
         "type": "github"
       },
       "original": {
@@ -434,11 +437,11 @@
     },
     "nixpkgs_3": {
       "locked": {
-        "lastModified": 1751011381,
-        "narHash": "sha256-krGXKxvkBhnrSC/kGBmg5MyupUUT5R6IBCLEzx9jhMM=",
+        "lastModified": 1753250450,
+        "narHash": "sha256-i+CQV2rPmP8wHxj0aq4siYyohHwVlsh40kV89f3nw1s=",
         "owner": "nixos",
         "repo": "nixpkgs",
-        "rev": "30e2e2857ba47844aa71991daa6ed1fc678bcbb7",
+        "rev": "fc02ee70efb805d3b2865908a13ddd4474557ecf",
         "type": "github"
       },
       "original": {
@@ -455,14 +458,14 @@
           "nixpkgs"
         ],
         "nuschtosSearch": "nuschtosSearch",
-        "systems": "systems_4"
+        "systems": "systems_5"
       },
       "locked": {
-        "lastModified": 1751144320,
-        "narHash": "sha256-KJsKiGfkfXFB23V26NQ1p+UPsexI6NKtivnrwSlWWdQ=",
+        "lastModified": 1753487377,
+        "narHash": "sha256-dEr3pYtC4/1PhP5ADIV8Fjjmxv6WC6UisQAUqtwdews=",
         "owner": "nix-community",
         "repo": "nixvim",
-        "rev": "ceb52aece5d571b37096945c2815604195a04eb4",
+        "rev": "3d09c8eaceb7a78ef9f5568024da1616f00c33e3",
         "type": "github"
       },
       "original": {
@@ -481,11 +484,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1749730855,
-        "narHash": "sha256-L3x2nSlFkXkM6tQPLJP3oCBMIsRifhIDPMQQdHO5xWo=",
+        "lastModified": 1753385846,
+        "narHash": "sha256-XDu9T2o6Rxe0acpchwQ2aXaRfE/uEYALpVbf+9QDEO4=",
         "owner": "NuschtOS",
         "repo": "search",
-        "rev": "8dfe5879dd009ff4742b668d9c699bc4b9761742",
+        "rev": "5c7e4eff303cba8447ffb443522b3c72bc47a9ba",
         "type": "github"
       },
       "original": {
@@ -510,7 +513,7 @@
         "nixvim": "nixvim",
         "sheet-organizer": "sheet-organizer",
         "sops-nix": "sops-nix",
-        "systems": "systems_6",
+        "systems": "systems_7",
         "yazi-flavors": "yazi-flavors"
       }
     },
@@ -543,11 +546,11 @@
         ]
       },
       "locked": {
-        "lastModified": 1750119275,
-        "narHash": "sha256-Rr7Pooz9zQbhdVxux16h7URa6mA80Pb/G07T4lHvh0M=",
+        "lastModified": 1752544651,
+        "narHash": "sha256-GllP7cmQu7zLZTs9z0J2gIL42IZHa9CBEXwBY9szT0U=",
         "owner": "Mic92",
         "repo": "sops-nix",
-        "rev": "77c423a03b9b2b79709ea2cb63336312e78b72e2",
+        "rev": "2c8def626f54708a9c38a5861866660395bb3461",
         "type": "github"
       },
       "original": {
@@ -632,6 +635,21 @@
       }
     },
     "systems_6": {
+      "locked": {
+        "lastModified": 1681028828,
+        "narHash": "sha256-Vy1rq5AaRuLzOxct8nz4T6wlgyUR7zLU309k9mBC768=",
+        "owner": "nix-systems",
+        "repo": "default",
+        "rev": "da67096a3b9bf56a91d16901293e51ba5b49a27e",
+        "type": "github"
+      },
+      "original": {
+        "owner": "nix-systems",
+        "repo": "default",
+        "type": "github"
+      }
+    },
+    "systems_7": {
       "locked": {
         "lastModified": 1689347949,
         "narHash": "sha256-12tWmuL2zgBgZkdoB6qXZsgJEH9LR3oUgpaQq2RbI80=",
@@ -667,11 +685,11 @@
     "yazi-flavors": {
       "flake": false,
       "locked": {
-        "lastModified": 1748603166,
-        "narHash": "sha256-m3yk6OcJ9vbCwtxkMRVUDhMMTOwaBFlqWDxGqX2Kyvc=",
+        "lastModified": 1751970029,
+        "narHash": "sha256-RtunaCs1RUfzjefFLFu5qLRASbyk5RUILWTdavThRkc=",
         "owner": "yazi-rs",
         "repo": "flavors",
-        "rev": "d04a298a8d4ada755816cb1a8cfb74dd46ef7124",
+        "rev": "d3fd3a5d774b48b3f88845f4f0ae1b82f106d331",
         "type": "github"
       },
       "original": {

homes/julian/features/hyprland/default.nix

@@ -162,7 +162,10 @@ in {
       monitor = ",preferred,auto,1";
 
       # Autostart
-      exec-once = ["firefox"];
+      exec-once = [
+        (lib.getExe pkgs.firefox)
+        (lib.getExe pkgs.waybar)
+      ];
 
       # Look and Feel
       general = {

homes/julian/features/hyprland/waybar/config.json

@@ -12,7 +12,14 @@
 
     "modules-center": [],
 
-    "modules-right": ["idle_inhibitor", "disk", "cpu", "memory", "pulseaudio", "battery", "clock", "tray"],
+    "modules-right": ["idle_inhibitor", "custom/nixos-update", "disk", "cpu", "memory", "pulseaudio", "battery", "clock", "tray"],
+
+    "custom/nixos-update": {
+        "exec": "frajul-auto-upgrade-status",
+        "return-type": "json",
+        "interval": 2,
+        "on-click-right": "frajul-auto-upgrade-toggle"
+    },
 
     "hyprland/workspaces": {
         "on-scroll-up": "hyprctl dispatch workspace m+1",
@@ -35,6 +42,7 @@
     },
 
     "idle_inhibitor": {
+        "start-activated": true,
         "format": "{icon}",
         "format-icons": {
             "activated": "",

homes/julian/features/hyprland/waybar/default.nix

@@ -10,7 +10,7 @@
 in {
   programs.waybar = {
     enable = true;
-    systemd.enable = true;
+    # systemd.enable = true;
     settings.mainBar = builtins.fromJSON (builtins.readFile ./config.json);
   };
 

homes/julian/features/neovim/default.nix

@@ -49,7 +49,7 @@
         key = "<leader><space>";
       }
       {
-        action = "<cmd>Telescope file_browser<cr>";
+        action = "<cmd>Telescope file_browser path=%:p:h<cr>";
         key = "<leader>.";
       }
       {
@@ -140,18 +140,21 @@
       };
 
       lsp = {
-        enable = true;
+        enable = true; # includes lsp-config, default settings for the lsps
         servers = {
           rust_analyzer = {
             enable = true;
             installCargo = true;
             installRustc = true;
           };
-          nixd.enable = true;
-          pyright.enable = true;
-          dockerls.enable = true;
-          lua_ls.enable = true;
-          clangd.enable = true;
+          nixd.enable = true; # nix
+          pyright.enable = true; # python
+          dockerls.enable = true; # docker
+          lua_ls.enable = true; # lua
+          clangd.enable = true; # c, c++
+          dartls.enable = true; # dart, flutter
+          digestif.enable = true; # latex
+          tinymist.enable = true; # typst
         };
       };
     };

homes/julian/features/suites/cli/default.nix

@@ -40,6 +40,7 @@
     wireguard-tools # wg-quick
     xorg.xkill
     zip
+    dig
 
     ## My scripts
     frajul.edit-config

homes/julian/global/default.nix

@@ -20,7 +20,7 @@
         "flakes"
         "ca-derivations"
       ];
-      # warn-dirty = false; # TODO: do I want it? also for systems
+      warn-dirty = false; # TODO: do I want it? also for systems
     };
   };
 

homes/julian/hm-standalone-config.nix

@@ -39,5 +39,8 @@
     ];
 
     # nix.settings. # warn-dirty = false; # TODO: do I want this
+    #
+    # Ensure we can still build when missing-server is not accessible
+    fallback = true;
   };
 }

hosts/aspi/default.nix

@@ -4,6 +4,7 @@
 
     ../common/global
     ../common/users/julian
+    ../common/users/yukari
     ../common/optional/binarycaches.nix
 
     ../common/optional/remote-builder.nix
@@ -32,8 +33,14 @@
       enable = true;
       overrideSettings = false;
     };
+    frajulAutoUpgrade = {
+      enable = true;
+      flakePath = "/home/julian/.dotfiles";
+    };
   };
 
+  services.desktopManager.plasma6.enable = true;
+
   services.blueman.enable = true;
   services.upower.enable = true;
 

hosts/builder/default.nix

@@ -41,6 +41,18 @@
     trusted-users = ["nix"];
     max-jobs = "auto";
     cores = 0;
+
+    # Ensure we can still build when missing-server is not accessible
+    fallback = true;
+  };
+
+  system.autoUpgrade = {
+    enable = true;
+    flake = "git+https://gitlab.julian-mutter.de/julian/dotfiles";
+    flags = [
+      "--recreate-lock-file" # update lock file
+    ];
+    dates = "02:13";
   };
 
   # optimize store by hardlinking store files

hosts/common/optional/binarycaches.nix

@@ -21,5 +21,8 @@
       "root"
       "@wheel"
     ]; # needed for devenv to add custom caches
+
+    # Ensure we can still build when missing-server is not accessible
+    fallback = true;
   };
 }

hosts/common/users/julian/default.nix

@@ -17,6 +17,8 @@ in {
       "networkmanager"
       "wheel"
       "audio"
+      "realtime"
+      "rtkit"
       "network"
       "video"
       "podman"

hosts/common/users/yukari/default.nix

@@ -0,0 +1,100 @@
+{
+  pkgs,
+  config,
+  lib,
+  outputs,
+  ...
+}: let
+  ifTheyExist = groups: builtins.filter (group: builtins.hasAttr group config.users.groups) groups;
+in {
+  users.mutableUsers = false;
+  users.users.yukari = {
+    description = "Yukari";
+    group = "yukari";
+    isNormalUser = true;
+    shell = pkgs.fish;
+    extraGroups = ifTheyExist [
+      "networkmanager"
+      "audio"
+      "network"
+      "video"
+      "podman"
+      "docker"
+      "git"
+      "gamemode"
+    ];
+
+    createHome = true;
+    hashedPassword = "$y$j9T$rGuTL0rfiy7ht8L58BGCw0$fN.KwHjYlIitFEPHndKvV06ezgeWzP3/58o1kkviZwB";
+    packages = [pkgs.home-manager];
+  };
+  users.groups.yukari = {};
+
+  home-manager.users.yukari = {
+    imports =
+      [
+        ../../../../homes/julian/features/fonts
+        ../../../../homes/julian/features/suites/cli
+      ]
+      ++ (builtins.attrValues outputs.homeManagerModules);
+
+    home = {
+      username = lib.mkDefault "yukari";
+      homeDirectory = lib.mkDefault "/home/${config.home.username}";
+      stateVersion = lib.mkDefault "23.11";
+
+      sessionPath = ["$HOME/.local/bin"];
+
+      packages = with pkgs; [
+        arandr
+        calibre # ebook manager and viewer
+        # digikam
+        discord
+        discord-ptb # in case discord updates take their time
+        # dvdisaster
+        # element-desktop
+        # rocketchat-desktop
+        thunderbird
+        tdesktop # telegram
+        # schildichat-desktop # not updated regularly
+        nheko
+        evince # Simple pdf reader, good for focusing on document content
+        firefox
+        vivaldi
+        # geogebra
+        cheese
+        handbrake
+        # kitty # Terminal, already available as feature
+        libnotify
+        libreoffice
+        mate.engrampa
+        nomacs # Image viewer
+        kdePackages.okular # Pdf reader with many features, good for commenting documents
+        pavucontrol
+        pdfsam-basic # Split, merge, etc for pdfs
+        qalculate-gtk # Nice gui calculator
+        qpdfview
+        # qutebrowser
+        # realvnc-vnc-viewer
+        rpi-imager # make isos
+        # rustdesk
+        tor-browser
+        unstable.path-of-building # Path of Building
+        # frajul.pob-dev-version # Path of Building
+        vlc
+        wineWowPackages.stable # 32-bit and 64-bit wine
+        winetricks
+        xclip # x11 clipboard access from terminal
+        xfce.mousepad # simple text editor
+        xournalpp # Edit pdf files
+        zoom-us # Video conferencing
+        zotero # Manage papers and other sources
+        pdfpc # Present slides in pdf form
+      ];
+    };
+    programs = {
+      home-manager.enable = true;
+      git.enable = true;
+    };
+  };
+}

modules/nixos/default.nix

@@ -1,4 +1,5 @@
 {
   # hydra-auto-upgrade = import ./hydra-auto-upgrade.nix;
   syncthing = import ./syncthing.nix;
+  frajulAutoUpgrade = import ./frajul-auto-upgrade.nix;
 }

modules/nixos/frajul-auto-upgrade.nix

@@ -0,0 +1,173 @@
+{
+  config,
+  lib,
+  pkgs,
+  ...
+}: let
+  cfg = config.modules.frajulAutoUpgrade;
+
+  flagFile = "/var/lib/frajul-auto-upgrade/flag";
+  lockFile = "/var/lib/frajul-auto-upgrade/lock";
+  lastStatusFile = "/var/lib/frajul-auto-upgrade/last-status";
+  lastAttemptFile = "/var/lib/frajul-auto-upgrade/last-attempt";
+in {
+  options.modules.frajulAutoUpgrade = {
+    enable = lib.mkEnableOption "NixOS auto-upgrade on boot";
+
+    user = lib.mkOption {
+      type = lib.types.str;
+      default = "root";
+      description = "User account to run the upgrade service as.";
+    };
+
+    flakePath = lib.mkOption {
+      type = lib.types.path;
+      description = "The path to your flake";
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    # Ensure the flag directory exists
+    systemd.tmpfiles.rules = [
+      "d /var/lib/frajul-auto-upgrade 0755 root root -"
+      "f ${flagFile} 0766 root root -"
+      "f ${lastStatusFile} 0644 root root -"
+      "f ${lastAttemptFile} 0644 root root -"
+    ];
+
+    environment.systemPackages = [
+      (pkgs.writeShellScriptBin "frajul-auto-upgrade" ''
+        #!/bin/sh
+        FLAG_FILE="${flagFile}"
+        LOCK_FILE="${lockFile}"
+        LAST_STATUS_FILE="${lastStatusFile}"
+        LAST_ATTEMPT_FILE="${lastAttemptFile}"
+
+        TODAY=$(date +%Y-%m-%d)
+
+        if [ ! -f "$FLAG_FILE" ] || [ "$(cat "$FLAG_FILE")" != "enabled" ]; then
+          echo "Auto upgrade disabled. Exiting."
+          exit 0
+        fi
+
+        # Check if already attempted today
+        if [ -f "$LAST_ATTEMPT_FILE" ]; then
+          LAST_ATTEMPT_DATE=$(cut -d' ' -f1 "$LAST_ATTEMPT_FILE")
+          if [ "$LAST_ATTEMPT_DATE" = "$TODAY" ]; then
+            echo "Update already attempted today. Skipping."
+            exit 0
+          fi
+        fi
+
+        if [ -f "$LOCK_FILE" ]; then
+          echo "Already running"
+          exit 1
+        fi
+
+        echo $$ > "$LOCK_FILE"
+        trap 'rm -f "$LOCK_FILE"' EXIT
+
+        if /run/current-system/sw/bin/nix flake update --flake "${cfg.flakePath}" && /run/current-system/sw/bin/nixos-rebuild switch --flake "${cfg.flakePath}"; then
+            echo "success" > "$LAST_STATUS_FILE"
+        else
+            echo "failure" > "$LAST_STATUS_FILE"
+            git -C "${cfg.flakePath}" restore flake.lock
+        fi
+
+        # Write full timestamp
+        date '+%Y-%m-%d %H:%M:%S' > "$LAST_ATTEMPT_FILE"
+      '')
+
+      (pkgs.writeShellScriptBin "frajul-auto-upgrade-status" ''
+        #!/bin/sh
+        FLAG_FILE="${flagFile}"
+        LOCK_FILE="${lockFile}"
+        LAST_STATUS_FILE="${lastStatusFile}"
+        LAST_ATTEMPT_FILE="${lastAttemptFile}"
+
+        if [ -f "$LOCK_FILE" ]; then
+          ICON=" "
+          STATUS="running"
+        elif [ -f "$FLAG_FILE" ] && [ "$(cat "$FLAG_FILE")" == "enabled" ]; then
+          LAST_STATUS="unknown"
+          LAST_ATTEMPT="never"
+          if [ -f "$LAST_STATUS_FILE" ]; then
+            LAST_STATUS=$(cat "$LAST_STATUS_FILE")
+          fi
+
+          if [ -f "$LAST_ATTEMPT_FILE" ]; then
+            LAST_ATTEMPT=$(cat "$LAST_ATTEMPT_FILE")
+          fi
+
+          if [ "$LAST_STATUS" = "success" ]; then
+            ICON=""
+          elif [ "$LAST_STATUS" = "failure" ]; then
+            ICON=""
+          else
+            ICON=""
+          fi
+
+          STATUS="enabled (last attempt: $LAST_ATTEMPT, $LAST_STATUS)"
+        else
+          ICON=" "
+          STATUS="disabled"
+        fi
+
+        echo "{\"text\": \"$ICON\", \"tooltip\": \"NixOS Auto Update: $STATUS\"}"
+      '')
+
+      (pkgs.writeShellScriptBin "frajul-auto-upgrade-toggle" ''
+        #!/bin/sh
+        FLAG_FILE="${flagFile}"
+        LOCK_FILE="${lockFile}"
+
+        if [ ! -f "$FLAG_FILE" ] || [ "$(cat "$FLAG_FILE")" != "enabled" ]; then
+          echo "enabled" > "$FLAG_FILE"
+        else
+          echo "disabled" > "$FLAG_FILE"
+          if [ -f "$LOCK_FILE" ]; then
+            kill -TERM "$(cat "$LOCK_FILE")"
+          fi
+        fi
+      '')
+    ];
+
+    # Fixes error: repository path '...' is not owned by current user
+    environment.etc."root/.gitconfig".text = ''
+      [safe]
+        directory = ${cfg.flakePath}
+    '';
+
+    systemd.services.frajul-auto-upgrade = {
+      description = "Frajul's NixOS Auto Upgrade";
+      after = ["network-online.target"];
+      wants = ["network-online.target"];
+      restartIfChanged = false; # Do not start service on nixos switch
+
+      path = with pkgs; [
+        coreutils
+        gnutar
+        xz.bin
+        gzip
+        gitMinimal
+        config.nix.package.out
+        config.programs.ssh.package
+      ];
+
+      serviceConfig = {
+        Type = "oneshot";
+        User = cfg.user;
+        ExecStart = "/run/current-system/sw/bin/frajul-auto-upgrade";
+      };
+    };
+    systemd.timers.frajul-auto-upgrade = {
+      description = "Run Frajul's NixOS Auto Upgrade at boot";
+      wantedBy = ["timers.target"];
+      timerConfig = {
+        OnBootSec = "1min";
+        AccuracySec = "10s";
+        Unit = "frajul-auto-upgrade.service";
+      };
+    };
+  };
+}