---
# Debian/Ubuntu-generic — not k3s-specific, kept independent of roles/k3s_node
# so it can be pointed at any apt-based host later (a Proxmox guest, say)
# without dragging k3s along. Currently only applied to k3s_cluster, from
# playbooks/k3s.yml.
#
# Installs updates hands-off, but leaves rebooting to
# playbooks/k3s_maintenance.yml — see unattended_upgrades_automatic_reboot in
# defaults/main.yml for why.

- name: Install unattended-upgrades
  ansible.builtin.apt:
    name:
      - unattended-upgrades
      - update-notifier-common
    state: present
    update_cache: true
    cache_valid_time: 3600

- name: Configure unattended-upgrades
  ansible.builtin.template:
    src: 50unattended-upgrades.j2
    dest: /etc/apt/apt.conf.d/50unattended-upgrades
    owner: root
    group: root
    mode: "0644"
  notify: restart unattended-upgrades

- name: Enable periodic apt updates and unattended-upgrades
  ansible.builtin.copy:
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    content: |
      APT::Periodic::Update-Package-Lists "1";
      APT::Periodic::Unattended-Upgrade "1";
    owner: root
    group: root
    mode: "0644"

- name: Ensure unattended-upgrades is enabled and running
  ansible.builtin.systemd_service:
    name: unattended-upgrades
    enabled: true
    state: started