49 lines
1.5 KiB
YAML
49 lines
1.5 KiB
YAML
---
|
|
- name: Require an allowed origin for the distribution
|
|
ansible.builtin.assert:
|
|
that:
|
|
- (unattended_upgrades.origins_pattern[ansible_distribution] | default([]) + unattended_upgrades.allowed_origins[ansible_distribution] | default([])) | length > 0
|
|
fail_msg: unattended_upgrades has no origins for {{ ansible_distribution }}
|
|
|
|
- name: Install unattended-upgrades
|
|
ansible.builtin.apt:
|
|
name: unattended-upgrades
|
|
state: present
|
|
|
|
- name: Enable the daily package list update and upgrade
|
|
ansible.builtin.template:
|
|
src: 20auto-upgrades.j2
|
|
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
|
mode: "0644"
|
|
|
|
# Separate file, the package owns 50unattended-upgrades.
|
|
- name: Configure unattended-upgrades
|
|
ansible.builtin.template:
|
|
src: 52unattended-upgrades-local.j2
|
|
dest: /etc/apt/apt.conf.d/52unattended-upgrades-local
|
|
mode: "0644"
|
|
|
|
# Debian installs apt-listchanges with email_address=root, which mails the NEWS of every
|
|
# unattended upgrade through the mail relay.
|
|
- name: Check for the apt-listchanges config
|
|
ansible.builtin.stat:
|
|
path: /etc/apt/listchanges.conf
|
|
register: unattended_upgrades_listchanges
|
|
|
|
- name: Disable the apt-listchanges mails
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/apt/listchanges.conf
|
|
regexp: '^email_address='
|
|
line: email_address=none
|
|
insertafter: '^\[apt\]'
|
|
when: unattended_upgrades_listchanges.stat.exists
|
|
|
|
- name: Enable the apt timers
|
|
ansible.builtin.systemd:
|
|
name: "{{ item }}"
|
|
enabled: true
|
|
state: started
|
|
loop:
|
|
- apt-daily.timer
|
|
- apt-daily-upgrade.timer
|