---
- name: Install update automation packages
  ansible.builtin.apt:
    name:
      - unattended-upgrades
      - needrestart
    state: present
  tags: [updates]

- name: Configure unattended upgrades
  ansible.builtin.template:
    src: 50unattended-upgrades.j2
    dest: /etc/apt/apt.conf.d/50unattended-upgrades
    owner: root
    group: root
    mode: "0644"
  notify: restart unattended-upgrades
  tags: [updates]

- name: Enable periodic apt updates
  ansible.builtin.copy:
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    owner: root
    group: root
    mode: "0644"
    content: |
      APT::Periodic::Update-Package-Lists "1";
      APT::Periodic::Unattended-Upgrade "1";
      APT::Periodic::AutocleanInterval "7";
  notify: restart unattended-upgrades
  tags: [updates]

- name: Enable unattended-upgrades service
  ansible.builtin.service:
    name: unattended-upgrades
    enabled: true
    state: started
  tags: [updates]