---
- name: Install unattended-upgrades
  ansible.builtin.apt:
    name: unattended-upgrades
    state: present

- name: Enable periodic apt update and unattended upgrades
  ansible.builtin.copy:
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    content: |
      APT::Periodic::Update-Package-Lists "1";
      APT::Periodic::Unattended-Upgrade "1";
      APT::Periodic::Download-Upgradeable-Packages "1";
      APT::Periodic::AutocleanInterval "7";
    owner: root
    group: root
    mode: "0644"

- name: Restrict unattended upgrades to the security pocket and enable auto-reboot window
  ansible.builtin.template:
    src: 52unattended-upgrades-local.j2
    dest: /etc/apt/apt.conf.d/52unattended-upgrades-local
    owner: root
    group: root
    mode: "0644"

- name: Ensure the unattended-upgrades timer is running
  ansible.builtin.systemd:
    name: unattended-upgrades.service
    enabled: true
    state: started