ansible/roles/unattended_upgrades/templates/20auto-upgrades.j2 at 5763df90f83ec035fd49f4de770d5b56e28dbfaf - ansible - Personal gitea instance

martin/ansible

Files

Martin Bauer f043606466 Add deliberate update playbook and unattended-upgrades role

Regular playbooks now use state: present, so they no longer upgrade
packages as a side effect. This adds two separate, explicit mechanisms
to keep the fleet patched instead:

- update-packages.yml: ad hoc / to-be-scheduled fleet-wide upgrade
  (safe by default, dist available via -e), plus
  update-packages-pinned-example.yml as a template for pinning or
  bumping a single package outside that.
- roles/unattended_upgrades: automatic security-only patching via
  unattended-upgrades, with a scheduled reboot window and mail
  left disabled pending a configured MTA. Applied to every host in
  full.yml and server.yml.

Also removes a leftover `upgrade: yes` apt task from pi_standard_setup
and server_basic_environment that was still doing a full upgrade on
every routine run, defeating the point of the state: present switch.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-09-08 18:02:41 +02:00

8 lines

280 B

Django/Jinja

Raw Blame History

 // Managed by Ansible (roles/unattended_upgrades) — changes will be overwritten.
 APT::Periodic::Update-Package-Lists "1";
 APT::Periodic::Download-Upgradeable-Packages "1";
 APT::Periodic::AutocleanInterval "7";
 APT::Periodic::Unattended-Upgrade "1";
 APT::Periodic::Verbose "1";