// Managed by Ansible (roles/unattended_upgrades) — edits here are overwritten
// on the next run.

Unattended-Upgrade::Allowed-Origins {
{% for origin in unattended_upgrades_origins %}
        "{{ origin }}";
{% endfor %}
};

Unattended-Upgrade::Remove-Unused-Dependencies "{{ unattended_upgrades_remove_unused_deps | lower }}";
Unattended-Upgrade::Remove-Unused-Kernel-Packages "{{ unattended_upgrades_remove_unused_kernel_packages | lower }}";

// The whole point of this role: never reboot on its own. A reboot-required
// package (kernel, libc, ...) is left applied-but-inactive until
// playbooks/k3s_maintenance.yml (role k3s_maintenance) drains this node and
// reboots it deliberately, one node at a time.
Unattended-Upgrade::Automatic-Reboot "{{ unattended_upgrades_automatic_reboot | lower }}";