Add an unattended_upgrades role that installs only Debian and Ubuntu security updates, with no automatic reboot

unattended_upgrades/tasks/main.yml

@@ -0,0 +1,33 @@
+---
+- name: Require an allowed origin for the distribution
+  ansible.builtin.assert:
+    that:
+      - (unattended_upgrades.origins_pattern[ansible_distribution] | default([]) + unattended_upgrades.allowed_origins[ansible_distribution] | default([])) | length > 0
+    fail_msg: unattended_upgrades has no origins for {{ ansible_distribution }}
+
+- name: Install unattended-upgrades
+  ansible.builtin.apt:
+    name: unattended-upgrades
+    state: present
+
+- name: Enable the daily package list update and upgrade
+  ansible.builtin.template:
+    src: 20auto-upgrades.j2
+    dest: /etc/apt/apt.conf.d/20auto-upgrades
+    mode: "0644"
+
+# Separate file, the package owns 50unattended-upgrades.
+- name: Configure unattended-upgrades
+  ansible.builtin.template:
+    src: 52unattended-upgrades-local.j2
+    dest: /etc/apt/apt.conf.d/52unattended-upgrades-local
+    mode: "0644"
+
+- name: Enable the apt timers
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    enabled: true
+    state: started
+  loop:
+    - apt-daily.timer
+    - apt-daily-upgrade.timer