diff --git a/defaults/main.yml b/defaults/main.yml index 372d2d1..be20aa5 100644 --- a/defaults/main.yml +++ b/defaults/main.yml @@ -2,4 +2,19 @@ # defaults file for sa-secure-automatic-updates role_dir: "{{role_path}}" -updates_notify_email: "root@locahost" + +# settings from 50unattended-upgrades +updates_notify_email: "root@locahost" +updates_automatic_reboot: true +updates_remove_unused_dependencies: true + +# settings from 10periodic +updates_update_package_lists: 1 +updates_download_upgradeable_packages: 1 +updates_autoclean_interval: 1 +updates_unattended_upgrade: 1 +updates_random_sleep: 1 + +# setting from apt-daily-timer-d-override.conf +updates_on_calendar: "01:00" +updates_randomized_delay: "1h" diff --git a/tasks/__detect_init_system.yml b/tasks/__detect_init_system.yml deleted file mode 100644 index 95196b2..0000000 --- a/tasks/__detect_init_system.yml +++ /dev/null @@ -1,16 +0,0 @@ ---- - - name: USE | Detect upstart system - shell: | - if [[ `/sbin/init --version 2> /dev/null` =~ upstart ]]; then echo upstart; - elif [[ `systemctl` =~ -\.mount ]]; then echo systemd; - elif [[ -f /etc/init.d/cron && ! -h /etc/init.d/cron ]]; then echo sysv-init; - else echo UNKNOWN; - fi - become: yes - args: - executable: /bin/bash - register: upstart_detect_raw - changed_when: False - - - set_fact: - upstart_system: "{{upstart_detect_raw.stdout}}" diff --git a/tasks/tasks_secure_updates.yml b/tasks/tasks_secure_updates.yml index d74d7ef..52aec5b 100644 --- a/tasks/tasks_secure_updates.yml +++ b/tasks/tasks_secure_updates.yml @@ -1,5 +1,4 @@ --- - - include: __detect_init_system.yml - name: Automatic Security Updates | Configure unattended-upgrades template: @@ -16,7 +15,7 @@ tags: - securityupdates - - block: #classic way via unattended-upgrades + - block: #except docker_test - name: Automatic Security Updates | Install dependencies apt: pkg="unattended-upgrades" @@ -24,10 +23,6 @@ tags: - securityupdates - when: (upstart_system == "upstart") and (docker_test is not defined) - - - block: #systemd way - - name: Automatic Security Updates | Make unattended upgrades run between 0100 - 0200 | Create systemd override directory file: path: "/etc/systemd/system/apt-daily.timer.d/" @@ -40,7 +35,6 @@ tags: - securityupdates - - name: Automatic Security Updates | Make unattended upgrades run between 0100 - 0200 | Copy override template template: src: "{{role_dir}}/templates/security/apt-daily-timer-d-override.conf.j2" @@ -53,18 +47,16 @@ tags: - securityupdates - - name: Automatic Security Updates | Configure | Make unattended upgrades run between 0100 - 0200 | Re-read systemd configuration command: "/bin/systemctl daemon-reload" become: yes tags: - securityupdates - - name: Automatic Security Updates | Configure | Make unattended upgrades run between 0100 - 0200 | Restart apt-daily.timer service: name="apt-daily.timer" state=restarted become: yes tags: - securityupdates - when: (upstart_system == "systemd") and (docker_test is not defined) + when: docker_test is not defined diff --git a/templates/security/10periodic.j2 b/templates/security/10periodic.j2 index 944635c..2cdd903 100644 --- a/templates/security/10periodic.j2 +++ b/templates/security/10periodic.j2 @@ -1,5 +1,5 @@ -APT::Periodic::Update-Package-Lists "1"; -APT::Periodic::Download-Upgradeable-Packages "1"; -APT::Periodic::AutocleanInterval "1"; -APT::Periodic::Unattended-Upgrade "1"; -APT::Periodic::RandomSleep "1"; +APT::Periodic::Update-Package-Lists "{{updates_update_package_lists}}"; +APT::Periodic::Download-Upgradeable-Packages "{{updates_download_upgradeable_packages}}"; +APT::Periodic::AutocleanInterval "{{updates_autoclean_interval}}"; +APT::Periodic::Unattended-Upgrade "{{updates_unattended_upgrade}}"; +APT::Periodic::RandomSleep "{{updates_random_sleep}}"; diff --git a/templates/security/50unattended-upgrades.j2 b/templates/security/50unattended-upgrades.j2 index 6475870..4c22d39 100644 --- a/templates/security/50unattended-upgrades.j2 +++ b/templates/security/50unattended-upgrades.j2 @@ -19,8 +19,8 @@ Unattended-Upgrade::Mail "{{updates_notify_email}}"; // Do automatic removal of new unused dependencies after the upgrade // (equivalent to apt-get autoremove) -Unattended-Upgrade::Remove-Unused-Dependencies "true"; +Unattended-Upgrade::Remove-Unused-Dependencies "{{updates_remove_unused_dependencies}}"; // Automatically reboot *WITHOUT CONFIRMATION* if a // the file /var/run/reboot-required is found after the upgrade -Unattended-Upgrade::Automatic-Reboot "true"; +Unattended-Upgrade::Automatic-Reboot "{{updates_automatic_reboot}}"; diff --git a/templates/security/apt-daily-timer-d-override.conf.j2 b/templates/security/apt-daily-timer-d-override.conf.j2 index 4abc695..d0798f0 100644 --- a/templates/security/apt-daily-timer-d-override.conf.j2 +++ b/templates/security/apt-daily-timer-d-override.conf.j2 @@ -1,4 +1,3 @@ [Timer] -OnCalendar= -OnCalendar=01:00 -RandomizedDelaySec=1h +OnCalendar={{updates_on_calendar}} +RandomizedDelaySec={{updates_randomized_delay}}