---
- name: Require an allowed origin for the distribution
  ansible.builtin.assert:
    that:
      - (unattended_upgrades.origins_pattern[ansible_distribution] | default([]) + unattended_upgrades.allowed_origins[ansible_distribution] | default([])) | length > 0
    fail_msg: unattended_upgrades has no origins for {{ ansible_distribution }}

- name: Install unattended-upgrades
  ansible.builtin.apt:
    name: unattended-upgrades
    state: present

- name: Enable the daily package list update and upgrade
  ansible.builtin.template:
    src: 20auto-upgrades.j2
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    mode: "0644"

# Separate file, the package owns 50unattended-upgrades.
- name: Configure unattended-upgrades
  ansible.builtin.template:
    src: 52unattended-upgrades-local.j2
    dest: /etc/apt/apt.conf.d/52unattended-upgrades-local
    mode: "0644"

# Debian installs apt-listchanges with email_address=root, which mails the NEWS of every
# unattended upgrade through the mail relay.
- name: Check for the apt-listchanges config
  ansible.builtin.stat:
    path: /etc/apt/listchanges.conf
  register: unattended_upgrades_listchanges

- name: Disable the apt-listchanges mails
  ansible.builtin.lineinfile:
    path: /etc/apt/listchanges.conf
    regexp: '^email_address='
    line: email_address=none
    insertafter: '^\[apt\]'
  when: unattended_upgrades_listchanges.stat.exists

- name: Enable the apt timers
  ansible.builtin.systemd:
    name: "{{ item }}"
    enabled: true
    state: started
  loop:
    - apt-daily.timer
    - apt-daily-upgrade.timer