Add an unattended_upgrades role that installs only Debian and Ubuntu security updates, with no automatic reboot

unattended_upgrades/defaults/main.yml

@@ -0,0 +1,16 @@
+---
+unattended_upgrades:
+  # Security updates only. Third-party repositories (Docker, Kopia, CrowdSec, NetBird, Proxmox, GitLab) stay out:
+  # an update of docker-ce or a pve package restarts every container or guest.
+  # Keyed by ansible_distribution; Debian lists go to Origins-Pattern, Ubuntu lists to Allowed-Origins.
+  origins_pattern:
+    Debian:
+      - origin=Debian,codename=${distro_codename}-security,label=Debian-Security
+  allowed_origins:
+    Ubuntu:
+      - ${distro_id}:${distro_codename}-security
+      - ${distro_id}ESMApps:${distro_codename}-apps-security
+      - ${distro_id}ESM:${distro_codename}-infra-security
+  # Recipient of the report mail; unset sends none, as no host has an outgoing mail setup.
+  mail:
+  mail_report: only-on-error