90 lines
2.2 KiB
YAML
90 lines
2.2 KiB
YAML
---
|
|
- name: Upgrade all system packages
|
|
ansible.builtin.apt:
|
|
upgrade: full
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
autoclean: true
|
|
autoremove: true
|
|
|
|
- name: Install common packages
|
|
ansible.builtin.apt:
|
|
name:
|
|
- apt-transport-https
|
|
- arptables
|
|
- ebtables
|
|
- ca-certificates
|
|
- curl
|
|
- ebtables
|
|
- gdisk
|
|
- hdparm
|
|
- htop
|
|
- iputils-ping
|
|
- ipvsadm
|
|
- lvm2
|
|
- nano
|
|
- net-tools
|
|
- nfs-common
|
|
- nvme-cli
|
|
- open-iscsi
|
|
- psmisc
|
|
- smartmontools
|
|
- socat
|
|
- software-properties-common
|
|
- unattended-upgrades
|
|
- unzip
|
|
install_recommends: false
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
autoclean: true
|
|
autoremove: true
|
|
|
|
- name: Install raspberry specific packages
|
|
ansible.builtin.apt:
|
|
name:
|
|
- linux-modules-extra-raspi
|
|
install_recommends: false
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
autoclean: true
|
|
autoremove: true
|
|
when: "'raspi' in ansible_kernel"
|
|
|
|
- name: Copy 20auto-upgrades unattended-upgrades config
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/apt/apt.conf.d/20auto-upgrades
|
|
mode: 0644
|
|
create: true
|
|
block: |
|
|
APT::Periodic::Update-Package-Lists "1";
|
|
APT::Periodic::Download-Upgradeable-Packages "1";
|
|
APT::Periodic::AutocleanInterval "7";
|
|
APT::Periodic::Unattended-Upgrade "1";
|
|
|
|
- name: Copy 50unattended-upgrades unattended-upgrades config
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/apt/apt.conf.d/50unattended-upgrades
|
|
mode: 0644
|
|
create: true
|
|
block: |
|
|
Unattended-Upgrade::Automatic-Reboot "false";
|
|
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
|
Unattended-Upgrade::Allowed-Origins {
|
|
"${distro_id} stable";
|
|
"${distro_id} ${distro_codename}-security";
|
|
"${distro_id} ${distro_codename}-updates";
|
|
};
|
|
|
|
- name: Start unattended-upgrades service
|
|
ansible.builtin.systemd:
|
|
name: unattended-upgrades
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Restart unattended-upgrades service
|
|
ansible.builtin.service:
|
|
name: unattended-upgrades.service
|
|
daemon_reload: true
|
|
enabled: true
|
|
state: restarted
|