---
# Origins unattended-upgrades installs from — Ubuntu's own stock list
# (security, plus the ESM ones, which are inert without Ubuntu Pro attached
# rather than an error). Override per-host/group for less than this.
unattended_upgrades_origins:
  - "${distro_id}:${distro_codename}"
  - "${distro_id}:${distro_codename}-security"
  - "${distro_id}ESMApps:${distro_codename}-apps-security"
  - "${distro_id}ESM:${distro_codename}-infra-security"

# Never reboot automatically. playbooks/k3s_maintenance.yml (role
# k3s_maintenance) does that instead — draining the node first, one at a
# time — which is the entire reason this role exists rather than just
# `apt install unattended-upgrades` with Ubuntu's own defaults (which reboot
# at 02:00 unprompted, k3s node or not).
unattended_upgrades_automatic_reboot: false

unattended_upgrades_remove_unused_deps: true
unattended_upgrades_remove_unused_kernel_packages: true