---
# ============================================================================
# Unattended security upgrades (Debian family)
# ============================================================================

- name: Ensure unattended-upgrades is installed
  ansible.builtin.apt:
    name:
      - unattended-upgrades
      - apt-listchanges
    state: present

- name: Deploy 50unattended-upgrades configuration
  ansible.builtin.template:
    src: 50unattended-upgrades.j2
    dest: "{{ baseline_unattended_config_dir }}/50unattended-upgrades"
    owner: root
    group: root
    mode: "0644"
    backup: true

- name: Enable periodic upgrade timers
  ansible.builtin.copy:
    dest: "{{ baseline_unattended_config_dir }}/20auto-upgrades"
    owner: root
    group: root
    mode: "0644"
    content: |
      APT::Periodic::Update-Package-Lists "1";
      APT::Periodic::Unattended-Upgrade "1";
      APT::Periodic::AutocleanInterval "7";

- name: Ensure unattended-upgrades timer is running
  ansible.builtin.systemd:
    name: unattended-upgrades
    state: started
    enabled: true