Martin Bauer
f043606466
Regular playbooks now use state: present, so they no longer upgrade packages as a side effect. This adds two separate, explicit mechanisms to keep the fleet patched instead: - update-packages.yml: ad hoc / to-be-scheduled fleet-wide upgrade (safe by default, dist available via -e), plus update-packages-pinned-example.yml as a template for pinning or bumping a single package outside that. - roles/unattended_upgrades: automatic security-only patching via unattended-upgrades, with a scheduled reboot window and mail left disabled pending a configured MTA. Applied to every host in full.yml and server.yml. Also removes a leftover `upgrade: yes` apt task from pi_standard_setup and server_basic_environment that was still doing a full upgrade on every routine run, defeating the point of the state: present switch. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
22 lines
916 B
YAML
22 lines
916 B
YAML
---
|
|
# Restrict to security-origin updates only (not a full dist-upgrade).
|
|
unattended_upgrades_security_only: true
|
|
|
|
# Extra Origins-Pattern lines appended verbatim, for when
|
|
# unattended_upgrades_security_only is turned off later (e.g. to also allow
|
|
# the "-updates" pocket). Left empty by default.
|
|
unattended_upgrades_origins_extra: []
|
|
|
|
# Reboot handling. Off by default would mean patches needing a reboot never
|
|
# take effect until someone reboots manually; scheduled means an automatic
|
|
# reboot at a fixed, low-traffic time on the days it's actually needed.
|
|
unattended_upgrades_auto_reboot: true
|
|
unattended_upgrades_auto_reboot_time: "03:00"
|
|
|
|
unattended_upgrades_remove_unused_deps: true
|
|
|
|
# Set to a mail address (and ensure a working mail transport is configured
|
|
# on the host) to get notified on failure. Empty disables mail entirely.
|
|
unattended_upgrades_mail_to: ""
|
|
unattended_upgrades_mail_on_only_error: true
|