unattended-upgrades must always be installed

defaults/main.yml

@@ -2,4 +2,19 @@
 # defaults file for sa-secure-automatic-updates
 
 role_dir: "{{role_path}}"
-updates_notify_email: "root@locahost"
+
+# settings from 50unattended-upgrades
+updates_notify_email:                   "root@locahost"
+updates_automatic_reboot:               true
+updates_remove_unused_dependencies:     true
+
+# settings from 10periodic
+updates_update_package_lists:           1
+updates_download_upgradeable_packages:  1
+updates_autoclean_interval:             1
+updates_unattended_upgrade:             1
+updates_random_sleep:                   1
+
+# setting from apt-daily-timer-d-override.conf
+updates_on_calendar:                    "01:00"
+updates_randomized_delay:               "1h"

tasks/tasks_secure_updates.yml

@@ -1,5 +1,4 @@
 ---
-  - include: __detect_init_system.yml
 
   - name: Automatic Security Updates | Configure unattended-upgrades
     template:
@@ -16,18 +15,14 @@
     tags:
       - securityupdates
 
-  - block: #classic way via unattended-upgrades
+  - block: #except docker_test
 
     - name: Automatic Security Updates | Install dependencies
       apt: pkg="unattended-upgrades"
       become: yes
       tags:
         - securityupdates
 
-    when: (upstart_system == "upstart") and (docker_test is not defined)
-
-  - block: #systemd way
-
     - name: Automatic Security Updates | Make unattended upgrades run between 0100 - 0200 | Create systemd override directory
       file:
         path: "/etc/systemd/system/apt-daily.timer.d/"
@@ -40,7 +35,6 @@
       tags:
         - securityupdates
 
-
     - name:  Automatic Security Updates | Make unattended upgrades run between 0100 - 0200 | Copy override template
       template:
         src:   "{{role_dir}}/templates/security/apt-daily-timer-d-override.conf.j2"
@@ -53,18 +47,16 @@
       tags:
         - securityupdates
 
-
     - name:  Automatic Security Updates |  Configure | Make unattended upgrades run between 0100 - 0200 | Re-read systemd configuration
       command: "/bin/systemctl daemon-reload"
       become: yes
       tags:
         - securityupdates
 
-
     - name:  Automatic Security Updates |  Configure | Make unattended upgrades run between 0100 - 0200 | Restart apt-daily.timer
       service: name="apt-daily.timer" state=restarted
       become: yes
       tags:
         - securityupdates
 
-    when: (upstart_system == "systemd") and (docker_test is not defined)
+    when: docker_test is not defined

templates/security/10periodic.j2

@@ -1,5 +1,5 @@
-APT::Periodic::Update-Package-Lists "1";
-APT::Periodic::Download-Upgradeable-Packages "1";
-APT::Periodic::AutocleanInterval "1";
-APT::Periodic::Unattended-Upgrade "1";
-APT::Periodic::RandomSleep "1";
+APT::Periodic::Update-Package-Lists "{{updates_update_package_lists}}";
+APT::Periodic::Download-Upgradeable-Packages "{{updates_download_upgradeable_packages}}";
+APT::Periodic::AutocleanInterval "{{updates_autoclean_interval}}";
+APT::Periodic::Unattended-Upgrade "{{updates_unattended_upgrade}}";
+APT::Periodic::RandomSleep "{{updates_random_sleep}}";

templates/security/50unattended-upgrades.j2

@@ -19,8 +19,8 @@ Unattended-Upgrade::Mail "{{updates_notify_email}}";
 
 // Do automatic removal of new unused dependencies after the upgrade
 // (equivalent to apt-get autoremove)
-Unattended-Upgrade::Remove-Unused-Dependencies "true";
+Unattended-Upgrade::Remove-Unused-Dependencies "{{updates_remove_unused_dependencies}}";
 
 // Automatically reboot *WITHOUT CONFIRMATION* if a
 // the file /var/run/reboot-required is found after the upgrade
-Unattended-Upgrade::Automatic-Reboot "true";
+Unattended-Upgrade::Automatic-Reboot "{{updates_automatic_reboot}}";

templates/security/apt-daily-timer-d-override.conf.j2

@@ -1,4 +1,3 @@
 [Timer]
-OnCalendar=
-OnCalendar=01:00
-RandomizedDelaySec=1h
+OnCalendar={{updates_on_calendar}}
+RandomizedDelaySec={{updates_randomized_delay}}