modules/darwin/common: SoftwareUpdate config, rosetta

modules/darwin/common/default.nix

@@ -13,6 +13,7 @@ in
     ./network.nix
     ./optimise.nix
     ./reboot.nix
+    ./software-update.nix
     ./telegraf.nix
     ./upgrade-diff.nix
     ../../shared/known-hosts.nix

modules/darwin/common/software-update.nix

@@ -0,0 +1,23 @@
+{ lib, ... }:
+{
+  system.activationScripts.postActivation.text = lib.mkBefore ''
+    if ! pgrep -q oahd; then
+      echo installing rosetta... >&2
+      softwareupdate --install-rosetta --agree-to-license
+    fi
+  '';
+
+  system.defaults.CustomSystemPreferences = {
+    # check daily, install critical updates, disable macos updates
+    "/Library/Preferences/com.apple.SoftwareUpdate" = {
+      AutomaticallyInstallAppUpdates = false;
+      AutomaticallyInstallMacOSUpdates = false;
+      AutomaticCheckEnabled = true;
+      AutomaticDownload = false;
+      ConfigDataInstall = true;
+      CriticalUpdateInstall = true;
+      restrict-software-update-require-admin-to-install = true;
+      ScheduleFrequency = 1;
+    };
+  };
+}