# Please review my automatic upgrade with logging and cleanup

**URL:** https://discourse.nixos.org/t/please-review-my-automatic-upgrade-with-logging-and-cleanup/64046
**Category:** Help
**Created:** [May 9, 2025, 10:06am UTC](https://discourse.nixos.org/t/please-review-my-automatic-upgrade-with-logging-and-cleanup/64046 "2025-05-09T10:06:41Z")
**Posts on this page:** 1
**Showing post:** 7

<div class="post-metadata">

### Author: ![LinuxIsBest](https://discourse.nixos.org/letter_avatar_proxy/v4/letter/l/35a633/32.png) [@LinuxIsBest](https://discourse.nixos.org/u/LinuxIsBest)
#### Post date: [May 9, 2025, 1:04pm UTC](https://discourse.nixos.org/t/please-review-my-automatic-upgrade-with-logging-and-cleanup/64046/7 "2025-05-09T13:04:54Z")

</div>

Finally got this working. - Yay!

```auto
# ========================
# 🔄 About Automatic Upgrades
# ========================

# Automatically checks for and applies NixOS updates daily at 3:00 AM.
# It runs: `nixos-rebuild switch --upgrade`
#
# ✅ What it does:
# - Downloads the latest NixOS packages
# - Rebuilds your system with the new updates
# - Applies changes immediately (new software, fixes, etc.)
# - Saves a log to: /var/log/nixos-upgrade.log
#
# ⚠️ What it *doesn't* do:
# - ❌ Doesn't reboot your system — you still need to do that manually
# - ❌ Doesn't update Flatpak or home-manager apps
#
#

# Ensure logrotate state directory exists
system.activationScripts.ensureLogrotateStateDir.text = ''
  mkdir -p /var/lib/logrotate
  chown root:root /var/lib/logrotate
  chmod 755 /var/lib/logrotate
'';

systemd.services.nixos-upgrade = {
  description = "Automatic NixOS upgrade";
  enable = true;
  serviceConfig = {
    Type = "oneshot";
    Environment = [
  "PATH=${pkgs.nix}/bin:${pkgs.nixos-rebuild}/bin:/run/current-system/sw/bin:/bin:/usr/bin:/usr/local/bin"
  "NIX_PATH=nixpkgs=${toString <nixpkgs>}:nixos-config=/etc/nixos/configuration.nix"
];
    ExecStart = "/bin/sh -c 'set -euo pipefail; /run/current-system/sw/bin/touch /var/log/nixos-upgrade.log; /run/current-system/sw/bin/chmod 644 /var/log/nixos-upgrade.log; ${pkgs.nixos-rebuild}/bin/nixos-rebuild switch --upgrade 2>&1 | /run/current-system/sw/bin/tee -a /var/log/nixos-upgrade.log'";
    StandardOutput = "journal+console";
    StandardError = "journal+console";
  };
};

systemd.timers.nixos-upgrade = {
  description = "Daily NixOS upgrade at 3 AM";
  enable = true; # Ensure the service is enabled
  wantedBy = ["timers.target"];
  timerConfig = {
    OnCalendar = "*-*-* 03:00:00"; # Change this if 3 AM isn't a convenient time for you.
    Persistent = true;
    WakeSystem = true;
  };
};

# ========================
# 📑 Logrotate Setup for NixOS Upgrade Logs
# Declarative, 7-Day Rotation
# ========================

# Configure logrotate declaratively
# This keeps 7 days of logs. Change "rotate 7" below to keep more or fewer days.
environment.etc."logrotate.d/nixos-upgrade".text = ''
  /var/log/nixos-upgrade.log {
    daily
    missingok
    rotate 7
    compress
    delaycompress
    notifempty
    create 644 root root
  }
'';

# Systemd timer to rotate logs daily at 3:30 AM
systemd.services.logrotate-nixos-upgrade = {
  description = "Logrotate for NixOS upgrade logs";
  enable = true; # Ensure the service is enabled
  serviceConfig.Type = "oneshot";
  serviceConfig.ExecStart = "${pkgs.logrotate}/bin/logrotate /etc/logrotate.d/nixos-upgrade --state /var/lib/logrotate/status";
};

systemd.timers.logrotate-nixos-upgrade = {
  description = "Daily Logrotate for NixOS upgrade logs";
  wantedBy = ["timers.target"];
  timerConfig = {
    OnCalendar = "*-*-* 03:30:00"; # Log rotation happens 30 minutes after the upgrade to avoid overlap.
    Persistent = true;
    WakeSystem = true;
  };
};

# ========================
# 🗑️ Automatic System Cleanup (Garbage Collection)
# ========================
#
# This system runs a safe, automatic cleanup every Sunday at 4:00 AM.
# It removes unused system generations and outdated packages to free up space.
#
# ✅ What it does:
# - Runs: `nix-collect-garbage -d`
# - Deletes old, unused system versions (generations)
# - Frees disk space without affecting the active system
#
# ⚠️ What it doesn't do:
# - ❌ Doesn't touch the current or booted configuration
# - ❌ Doesn't reboot your machine
#
# 💡 Pro Tip:
# You can run it manually anytime:
#
# sudo nix-collect-garbage -d
#
# Safe to run regularly — it only deletes what's no longer in use.

systemd.services.nix-garbage-collect = {
  description = "Weekly Nix Garbage Collection";
  enable = true; # Ensure the service is enabled
  serviceConfig = {
    Type = "oneshot";
    ExecStart = "${pkgs.nix}/bin/nix-collect-garbage -d";
    StandardOutput = "journal";
    StandardError = "journal";
  };
};

systemd.timers.nix-garbage-collect = {
  description = "Weekly Nix Garbage Collection Timer";
  enable = true; # Ensure the service is enabled
  wantedBy = ["timers.target"];
  timerConfig = {
    OnCalendar = "Sun *-*-* 04:00:00"; # Every Sunday at 4 AM
    Persistent = true;
    WakeSystem = true;
  };
};

```

---

_[View the full topic](https://discourse.nixos.org/t/please-review-my-automatic-upgrade-with-logging-and-cleanup/64046)._