96 lines
2.5 KiB
YAML
96 lines
2.5 KiB
YAML
---
|
|
- name: Upgrade all system packages
|
|
ansible.builtin.apt:
|
|
upgrade: full
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
autoclean: true
|
|
autoremove: true
|
|
register: apt_upgrade
|
|
retries: 5
|
|
until: apt_upgrade is success
|
|
|
|
- name: Install common packages
|
|
ansible.builtin.apt:
|
|
name:
|
|
- apt-transport-https
|
|
- arptables
|
|
- ca-certificates
|
|
- curl
|
|
- ebtables
|
|
- iputils-ping
|
|
- ipvsadm
|
|
- lvm2
|
|
- net-tools
|
|
- nfs-common
|
|
- open-iscsi
|
|
- psmisc
|
|
- smartmontools
|
|
- software-properties-common
|
|
- unattended-upgrades
|
|
install_recommends: false
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
autoclean: true
|
|
autoremove: true
|
|
register: apt_install_common
|
|
retries: 5
|
|
until: apt_install_common is success
|
|
|
|
- name: Check if Raspberry Pi
|
|
command: grep -q "Raspberry Pi" /proc/cpuinfo
|
|
ignore_errors: true
|
|
register: is_raspberry
|
|
|
|
- name: Install raspberry specific packages for Ubuntu 21 or greater
|
|
ansible.builtin.apt:
|
|
name:
|
|
- linux-modules-extra-raspi
|
|
install_recommends: false
|
|
update_cache: true
|
|
cache_valid_time: 3600
|
|
autoclean: true
|
|
autoremove: true
|
|
register: apt_install_raspberry
|
|
retries: 5
|
|
until: apt_install_raspberry is success
|
|
when: is_raspberry and (ansible_lsb.major_release|int >= 21)
|
|
|
|
- name: Copy 20auto-upgrades unattended-upgrades config
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/apt/apt.conf.d/20auto-upgrades
|
|
mode: 0644
|
|
create: true
|
|
block: |
|
|
APT::Periodic::Update-Package-Lists "1";
|
|
APT::Periodic::Download-Upgradeable-Packages "1";
|
|
APT::Periodic::AutocleanInterval "7";
|
|
APT::Periodic::Unattended-Upgrade "1";
|
|
|
|
- name: Copy 50unattended-upgrades unattended-upgrades config
|
|
ansible.builtin.blockinfile:
|
|
path: /etc/apt/apt.conf.d/50unattended-upgrades
|
|
mode: 0644
|
|
create: true
|
|
block: |
|
|
Unattended-Upgrade::Automatic-Reboot "false";
|
|
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
|
Unattended-Upgrade::Allowed-Origins {
|
|
"${distro_id} stable";
|
|
"${distro_id} ${distro_codename}-security";
|
|
"${distro_id} ${distro_codename}-updates";
|
|
};
|
|
|
|
- name: Start unattended-upgrades service
|
|
ansible.builtin.systemd:
|
|
name: unattended-upgrades
|
|
enabled: true
|
|
state: started
|
|
|
|
- name: Restart unattended-upgrades service
|
|
ansible.builtin.service:
|
|
name: unattended-upgrades.service
|
|
daemon_reload: true
|
|
enabled: true
|
|
state: restarted
|