Initialise repository structure and placeholder files. Generic functionality works i guess, need to come up with a better solution for compose templates

2026-07-08 10:29:51 +01:00
commit 53695f4fff
@@ -0,0 +1,6 @@
+# updates
+
+Installs and configures unattended-upgrades and needrestart.
+
+Tags: `updates`.
+
@@ -0,0 +1,6 @@
+---
+updates_unattended_origins:
+  - origin=Debian,codename=${distro_codename},label=Debian
+  - origin=Debian,codename=${distro_codename}-security,label=Debian-Security
+updates_reboot: "false"
+
@@ -0,0 +1 @@
+
@@ -0,0 +1,6 @@
+---
+- name: restart unattended-upgrades
+  ansible.builtin.service:
+    name: unattended-upgrades
+    state: restarted
+
@@ -0,0 +1,39 @@
+---
+- name: Install update automation packages
+  ansible.builtin.apt:
+    name:
+      - unattended-upgrades
+      - needrestart
+    state: present
+  tags: [updates]
+
+- name: Configure unattended upgrades
+  ansible.builtin.template:
+    src: 50unattended-upgrades.j2
+    dest: /etc/apt/apt.conf.d/50unattended-upgrades
+    owner: root
+    group: root
+    mode: "0644"
+  notify: restart unattended-upgrades
+  tags: [updates]
+
+- name: Enable periodic apt updates
+  ansible.builtin.copy:
+    dest: /etc/apt/apt.conf.d/20auto-upgrades
+    owner: root
+    group: root
+    mode: "0644"
+    content: |
+      APT::Periodic::Update-Package-Lists "1";
+      APT::Periodic::Unattended-Upgrade "1";
+      APT::Periodic::AutocleanInterval "7";
+  notify: restart unattended-upgrades
+  tags: [updates]
+
+- name: Enable unattended-upgrades service
+  ansible.builtin.service:
+    name: unattended-upgrades
+    enabled: true
+    state: started
+  tags: [updates]
+
@@ -0,0 +1,7 @@
+Unattended-Upgrade::Origins-Pattern {
+{% for origin in updates_unattended_origins %}
+        "{{ origin }}";
+{% endfor %}
+};
+Unattended-Upgrade::Automatic-Reboot "{{ updates_reboot }}";
+