Martin Bauer
f043606466
Regular playbooks now use state: present, so they no longer upgrade packages as a side effect. This adds two separate, explicit mechanisms to keep the fleet patched instead: - update-packages.yml: ad hoc / to-be-scheduled fleet-wide upgrade (safe by default, dist available via -e), plus update-packages-pinned-example.yml as a template for pinning or bumping a single package outside that. - roles/unattended_upgrades: automatic security-only patching via unattended-upgrades, with a scheduled reboot window and mail left disabled pending a configured MTA. Applied to every host in full.yml and server.yml. Also removes a leftover `upgrade: yes` apt task from pi_standard_setup and server_basic_environment that was still doing a full upgrade on every routine run, defeating the point of the state: present switch. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
10 lines
502 B
Markdown
10 lines
502 B
Markdown
# unattended_upgrades
|
|
|
|
Installs and configures `unattended-upgrades` for automatic security
|
|
patching, separate from `update-packages.yml` (which handles deliberate,
|
|
scheduled full-package updates — see the repo README). Security-only by
|
|
default. Reboots when required, at a fixed scheduled time (default 03:00),
|
|
rather than never or immediately — see `defaults/main.yml` to change this.
|
|
Mail-on-failure is supported but disabled by default since no mail
|
|
transport is configured on these hosts yet.
|