I would like to see the PR below merged to improve the flexibility of the auto-upgrade service.
This PR allows to define a reboot window during which a server can be rebooted. By doing so, you avoid a critical server being rebooted outside it’s maintenance window.
I currently use this because I administer many remote systems, some of which are turned on and off daily, others running 24/7. I defined two moments for the auto upgrade, one at night and on during the day (performing a nixos-rebuild boot, not switch), to catch both situations. But reboots are only allowed during the night. Like this, in both cases the servers will receive updates and will reboot when required, either by the service during the night, or because they are manually rebooted daily.
Feel free to review if you would like to see this merged!