Add an unattended_upgrades role that installs only Debian and Ubuntu security updates, with no automatic reboot

2026-10-22 09:00:33 +00:00
parent bcdc460297
commit 381e1b285c
4 changed files with 83 additions and 0 deletions
@@ -0,0 +1,30 @@
+// {{ ansible_managed }}
+// Replaces the origins of 50unattended-upgrades; apt list options append otherwise.
+#clear Unattended-Upgrade::Allowed-Origins;
+#clear Unattended-Upgrade::Origins-Pattern;
+{% set patterns = unattended_upgrades.origins_pattern[ansible_distribution] | default([]) %}
+{% if patterns %}
+Unattended-Upgrade::Origins-Pattern {
+{% for origin in patterns %}
+    "{{ origin }}";
+{% endfor %}
+};
+{% endif %}
+{% set allowed = unattended_upgrades.allowed_origins[ansible_distribution] | default([]) %}
+{% if allowed %}
+Unattended-Upgrade::Allowed-Origins {
+{% for origin in allowed %}
+    "{{ origin }}";
+{% endfor %}
+};
+{% endif %}
+
+// No automatic reboot, the owner schedules those.
+Unattended-Upgrade::Automatic-Reboot "false";
+Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
+Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
+Unattended-Upgrade::Remove-Unused-Dependencies "false";
+{% if unattended_upgrades.mail %}
+Unattended-Upgrade::Mail "{{ unattended_upgrades.mail }}";
+Unattended-Upgrade::MailReport "{{ unattended_upgrades.mail_report }}";
+{% endif %}