depot/ops/nixos/lib/rebuilder.nix

{ system, depot, pkgs, ... }:
pkgs.writeShellScriptBin "rebuilder" ''
  set -ue
  if [[ $EUID -ne 0 ]]; then
    exec sudo "$0" "$@"
  fi

  DEPOT_PATH="''${1:-<depot>}"

  export AWS_ACCESS_KEY_ID="${depot.ops.secrets.nixCache.AWS_ACCESS_KEY_ID}"
  export AWS_SECRET_ACCESS_KEY="${depot.ops.secrets.nixCache.AWS_SECRET_ACCESS_KEY}"

  system="$(nix-build -E "(import $DEPOT_PATH {}).ops.nixos.${system}" --no-out-link)"
  nix-env -p /nix/var/nix/profiles/system --set "$system"
  "$system/bin/switch-to-configuration" switch
''