Martin Bauer
f043606466
Regular playbooks now use state: present, so they no longer upgrade packages as a side effect. This adds two separate, explicit mechanisms to keep the fleet patched instead: - update-packages.yml: ad hoc / to-be-scheduled fleet-wide upgrade (safe by default, dist available via -e), plus update-packages-pinned-example.yml as a template for pinning or bumping a single package outside that. - roles/unattended_upgrades: automatic security-only patching via unattended-upgrades, with a scheduled reboot window and mail left disabled pending a configured MTA. Applied to every host in full.yml and server.yml. Also removes a leftover `upgrade: yes` apt task from pi_standard_setup and server_basic_environment that was still doing a full upgrade on every routine run, defeating the point of the state: present switch. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
30 lines
1.1 KiB
YAML
30 lines
1.1 KiB
YAML
---
|
|
# Template, not run on any schedule. Copy this when a package needs a
|
|
# controlled bump outside update-packages.yml — e.g. a security fix you
|
|
# want before the next scheduled run, or a version you deliberately don't
|
|
# want update-packages.yml's `safe` upgrade to move past.
|
|
#
|
|
# Run explicitly against the hosts that need it:
|
|
# venv/bin/ansible-playbook update-packages-pinned-example.yml --limit <host>
|
|
|
|
- name: Pin a package to an exact version
|
|
hosts: all
|
|
tasks:
|
|
- name: Install nginx pinned to a specific version
|
|
ansible.builtin.apt:
|
|
name: "nginx=1.18.0-6.1+deb11u3"
|
|
state: present
|
|
update_cache: true
|
|
# Pinning like this also protects the package from update-packages.yml's
|
|
# `safe`/`dist` upgrade: apt won't move a pinned-by-version install
|
|
# past the given version on a plain upgrade.
|
|
|
|
- name: Bump a single named package to latest, deliberately
|
|
hosts: all
|
|
tasks:
|
|
- name: Upgrade openssl to latest available
|
|
ansible.builtin.apt:
|
|
name: openssl
|
|
state: latest # noqa: package-latest - deliberate, scoped to one named package, run ad hoc
|
|
update_cache: true
|