---
- name: Deploy Absolute Automation Unattended Upgrades
  hosts: all
  tasks:
    - name: Pre-seed debconf to enable automatic upgrades
      ansible.builtin.debconf:
        name: unattended-upgrades
        question: unattended-upgrades/enable_auto_updates
        value: "true"
        vtype: boolean

    - name: Install unattended-upgrades package
      ansible.builtin.apt:
        name: unattended-upgrades
        state: present
        update_cache: true

    - name: Ensure daily updates are activated
      ansible.builtin.copy:
        dest: /etc/apt/apt.conf.d/20auto-upgrades
        content: |
          APT::Periodic::Update-Package-Lists "1";
          APT::Periodic::Unattended-Upgrade "1";
        owner: root
        group: root
        mode: '0644'

    - name: Apply full wildcard and dist-upgrade allowance rules
      ansible.builtin.copy:
        dest: /etc/apt/apt.conf.d/52fully-automatic-origins
        content: |
          Unattended-Upgrade::Origins-Pattern {
                  "origin=*";
          };
          Unattended-Upgrade::Allow-New-Dependencies "true";
          Unattended-Upgrade::Remove-Unused-Dependencies "true";
          Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
        owner: root
        group: root
        mode: '0644'
