jack
5befd48a50
firewall.yml: - Allow 172.16.0.0/12 and 10.0.0.0/8 on ports 80/443 so act_runner job containers can reach git.csrx.ru (Forgejo via Traefik) - Without this, Cloudflare-only rules broke CI/CD pipeline unattended_upgrades.yml (new): - Install unattended-upgrades + apt-listchanges - Configure auto-apply of security patches only (not all updates) - Auto-clean every 7 days, remove unused deps - No auto-reboot (manual control over kernel reboots) base/tasks/main.yml: - Add unattended_upgrades.yml to task sequence Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
46 lines
1.4 KiB
YAML
46 lines
1.4 KiB
YAML
---
|
|
- name: Install unattended-upgrades
|
|
ansible.builtin.apt:
|
|
name:
|
|
- unattended-upgrades
|
|
- apt-listchanges
|
|
state: present
|
|
|
|
- name: Configure unattended-upgrades
|
|
ansible.builtin.copy:
|
|
dest: /etc/apt/apt.conf.d/50unattended-upgrades
|
|
content: |
|
|
Unattended-Upgrade::Allowed-Origins {
|
|
"${distro_id}:${distro_codename}-security";
|
|
"${distro_id}ESMApps:${distro_codename}-apps-security";
|
|
"${distro_id}ESM:${distro_codename}-infra-security";
|
|
};
|
|
|
|
// Automatically reboot if required (kernel updates etc.)
|
|
Unattended-Upgrade::Automatic-Reboot "false";
|
|
|
|
// Remove unused dependencies
|
|
Unattended-Upgrade::Remove-Unused-Dependencies "true";
|
|
Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
|
|
|
|
// Send email on errors (optional — comment out if no mail)
|
|
// Unattended-Upgrade::Mail "admin@csrx.ru";
|
|
|
|
// Minimum age of packages before auto-removing
|
|
Unattended-Upgrade::MinimalSteps "true";
|
|
mode: "0644"
|
|
|
|
- name: Enable automatic upgrades
|
|
ansible.builtin.copy:
|
|
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
|
content: |
|
|
APT::Periodic::Update-Package-Lists "1";
|
|
APT::Periodic::Unattended-Upgrade "1";
|
|
APT::Periodic::AutocleanInterval "7";
|
|
mode: "0644"
|
|
|
|
- name: Ensure unattended-upgrades service is running
|
|
ansible.builtin.systemd:
|
|
name: unattended-upgrades
|
|
state: started
|
|
enabled: true
|