Add an unattended_upgrades role that installs only Debian and Ubuntu security updates, with no automatic reboot

unattended_upgrades/templates/20auto-upgrades.j2

@@ -0,0 +1,4 @@
+// {{ ansible_managed }}
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Unattended-Upgrade "1";
+APT::Periodic::AutocleanInterval "7";

unattended_upgrades/templates/52unattended-upgrades-local.j2

@@ -0,0 +1,30 @@
+// {{ ansible_managed }}
+// Replaces the origins of 50unattended-upgrades; apt list options append otherwise.
+#clear Unattended-Upgrade::Allowed-Origins;
+#clear Unattended-Upgrade::Origins-Pattern;
+{% set patterns = unattended_upgrades.origins_pattern[ansible_distribution] | default([]) %}
+{% if patterns %}
+Unattended-Upgrade::Origins-Pattern {
+{% for origin in patterns %}
+    "{{ origin }}";
+{% endfor %}
+};
+{% endif %}
+{% set allowed = unattended_upgrades.allowed_origins[ansible_distribution] | default([]) %}
+{% if allowed %}
+Unattended-Upgrade::Allowed-Origins {
+{% for origin in allowed %}
+    "{{ origin }}";
+{% endfor %}
+};
+{% endif %}
+
+// No automatic reboot, the owner schedules those.
+Unattended-Upgrade::Automatic-Reboot "false";
+Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
+Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
+Unattended-Upgrade::Remove-Unused-Dependencies "false";
+{% if unattended_upgrades.mail %}
+Unattended-Upgrade::Mail "{{ unattended_upgrades.mail }}";
+Unattended-Upgrade::MailReport "{{ unattended_upgrades.mail_report }}";
+{% endif %}