From 0f8136432ddb5db97f05ea5286da919fb38d6d24 Mon Sep 17 00:00:00 2001
From: Devin Buhl <devin@buhl.casa>
Date: Mon, 16 May 2022 17:07:16 -0400
Subject: [PATCH] feat(ansible): add handler to restart node if needed

Signed-off-by: Devin Buhl <devin@buhl.casa>
---
 .../ansible/roles/ubuntu/handlers/main.yml    | 11 ++++
 provision/ansible/roles/ubuntu/tasks/main.yml |  4 ++
 .../ansible/roles/ubuntu/tasks/packages.yml   | 53 ++-----------------
 .../ubuntu/tasks/unattended-upgrades.yml      | 26 +++++++++
 4 files changed, 45 insertions(+), 49 deletions(-)
 create mode 100644 provision/ansible/roles/ubuntu/handlers/main.yml
 create mode 100644 provision/ansible/roles/ubuntu/tasks/unattended-upgrades.yml

diff --git a/provision/ansible/roles/ubuntu/handlers/main.yml b/provision/ansible/roles/ubuntu/handlers/main.yml
new file mode 100644
index 00000000..98f5f24d
--- /dev/null
+++ b/provision/ansible/roles/ubuntu/handlers/main.yml
@@ -0,0 +1,11 @@
+---
+- name: Restart node
+  ansible.builtin.reboot:
+    msg: Restart node due to system changes
+
+- name: Restart unattended-upgrades
+  ansible.builtin.service:
+    name: unattended-upgrades.service
+    daemon_reload: true
+    enabled: true
+    state: restarted
diff --git a/provision/ansible/roles/ubuntu/tasks/main.yml b/provision/ansible/roles/ubuntu/tasks/main.yml
index 988e976f..7f0f8c28 100644
--- a/provision/ansible/roles/ubuntu/tasks/main.yml
+++ b/provision/ansible/roles/ubuntu/tasks/main.yml
@@ -23,6 +23,10 @@
   tags:
     - filesystem
 
+- include: unattended-upgrades.yml
+  tags:
+    - unattended-upgrades
+
 - include: user.yml
   tags:
     - user
diff --git a/provision/ansible/roles/ubuntu/tasks/packages.yml b/provision/ansible/roles/ubuntu/tasks/packages.yml
index 1bf21888..670aab97 100644
--- a/provision/ansible/roles/ubuntu/tasks/packages.yml
+++ b/provision/ansible/roles/ubuntu/tasks/packages.yml
@@ -3,9 +3,6 @@
   ansible.builtin.apt:
     upgrade: full
     update_cache: true
-    cache_valid_time: 3600
-    autoclean: true
-    autoremove: true
 
 - name: Install common packages
   ansible.builtin.apt:
@@ -34,56 +31,14 @@
       - unattended-upgrades
       - unzip
     install_recommends: false
-    update_cache: true
-    cache_valid_time: 3600
-    autoclean: true
-    autoremove: true
 
-- name: Install raspberry specific packages
+- name: Install RasPi specific packages
   ansible.builtin.apt:
     name:
       - linux-modules-extra-raspi
     install_recommends: false
-    update_cache: true
-    cache_valid_time: 3600
-    autoclean: true
-    autoremove: true
+  notify: Restart node
   when: "'raspi' in ansible_kernel"
 
-- name: Copy 20auto-upgrades unattended-upgrades config
-  ansible.builtin.blockinfile:
-    path: /etc/apt/apt.conf.d/20auto-upgrades
-    mode: 0644
-    create: true
-    block: |
-      APT::Periodic::Update-Package-Lists "1";
-      APT::Periodic::Download-Upgradeable-Packages "1";
-      APT::Periodic::AutocleanInterval "7";
-      APT::Periodic::Unattended-Upgrade "1";
-
-- name: Copy 50unattended-upgrades unattended-upgrades config
-  ansible.builtin.blockinfile:
-    path: /etc/apt/apt.conf.d/50unattended-upgrades
-    mode: 0644
-    create: true
-    block: |
-      Unattended-Upgrade::Automatic-Reboot "false";
-      Unattended-Upgrade::Remove-Unused-Dependencies "true";
-      Unattended-Upgrade::Allowed-Origins {
-          "${distro_id} stable";
-          "${distro_id} ${distro_codename}-security";
-          "${distro_id} ${distro_codename}-updates";
-      };
-
-- name: Start unattended-upgrades service
-  ansible.builtin.systemd:
-    name: unattended-upgrades
-    enabled: true
-    state: started
-
-- name: Restart unattended-upgrades service
-  ansible.builtin.service:
-    name: unattended-upgrades.service
-    daemon_reload: true
-    enabled: true
-    state: restarted
+- name: Restart node if necessary
+  ansible.builtin.meta: flush_handlers
diff --git a/provision/ansible/roles/ubuntu/tasks/unattended-upgrades.yml b/provision/ansible/roles/ubuntu/tasks/unattended-upgrades.yml
new file mode 100644
index 00000000..7d215bb3
--- /dev/null
+++ b/provision/ansible/roles/ubuntu/tasks/unattended-upgrades.yml
@@ -0,0 +1,26 @@
+---
+- block:
+    - name: Copy 20auto-upgrades unattended-upgrades config
+      ansible.builtin.blockinfile:
+        path: /etc/apt/apt.conf.d/20auto-upgrades
+        mode: 0644
+        create: true
+        block: |
+          APT::Periodic::Update-Package-Lists "1";
+          APT::Periodic::Download-Upgradeable-Packages "1";
+          APT::Periodic::AutocleanInterval "7";
+          APT::Periodic::Unattended-Upgrade "1";
+    - name: Copy 50unattended-upgrades unattended-upgrades config
+      ansible.builtin.blockinfile:
+        path: /etc/apt/apt.conf.d/50unattended-upgrades
+        mode: 0644
+        create: true
+        block: |
+          Unattended-Upgrade::Automatic-Reboot "false";
+          Unattended-Upgrade::Remove-Unused-Dependencies "true";
+          Unattended-Upgrade::Allowed-Origins {
+              "${distro_id} stable";
+              "${distro_id} ${distro_codename}-security";
+              "${distro_id} ${distro_codename}-updates";
+          };
+  notify: Restart unattended-upgrades