initial commit

roles/patch_mgmt/tasks/main.yml

@@ -0,0 +1,90 @@
+---
+- name: Include OS-family-specific variables
+  ansible.builtin.include_vars: "{{ item }}"
+  with_first_found:
+    - "{{ ansible_facts['os_family'] }}.yml"
+    - "default.yml"
+  tags: [patch_mgmt, always]
+
+- name: Install patch management packages
+  ansible.builtin.package:
+    name: "{{ patch_mgmt_packages }}"
+    state: present
+  tags: [patch_mgmt]
+
+- name: Deploy dnf-automatic configuration (RedHat family)
+  ansible.builtin.template:
+    src: automatic.conf.j2
+    dest: /etc/dnf/automatic.conf
+    owner: root
+    group: root
+    mode: "0644"
+  when: ansible_facts['os_family'] == "RedHat"
+  tags: [patch_mgmt]
+
+- name: Enable dnf-automatic download timer (RedHat family)
+  ansible.builtin.systemd:
+    name: dnf-automatic.timer
+    enabled: true
+    state: started
+  when: ansible_facts['os_family'] == "RedHat"
+  tags: [patch_mgmt]
+
+- name: Deploy unattended-upgrades allowed-origins configuration (Debian family)
+  ansible.builtin.template:
+    src: 50unattended-upgrades.j2
+    dest: /etc/apt/apt.conf.d/50unattended-upgrades
+    owner: root
+    group: root
+    mode: "0644"
+  when: ansible_facts['os_family'] == "Debian"
+  tags: [patch_mgmt]
+
+- name: Deploy apt periodic update/upgrade configuration (Debian family)
+  ansible.builtin.template:
+    src: 20auto-upgrades.j2
+    dest: /etc/apt/apt.conf.d/20auto-upgrades
+    owner: root
+    group: root
+    mode: "0644"
+  when: ansible_facts['os_family'] == "Debian"
+  tags: [patch_mgmt]
+
+- name: Enable apt-daily timers (Debian family)
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    enabled: true
+    state: started
+  loop:
+    - apt-daily.timer
+    - apt-daily-upgrade.timer
+  when: ansible_facts['os_family'] == "Debian"
+  tags: [patch_mgmt]
+
+- name: Deploy reboot-required check script
+  ansible.builtin.template:
+    src: check-reboot-needed.sh.j2
+    dest: /usr/local/sbin/check-reboot-needed.sh
+    owner: root
+    group: root
+    mode: "0750"
+  tags: [patch_mgmt]
+
+- name: Schedule daily reboot-required check
+  ansible.builtin.cron:
+    name: "Check for pending reboot after patching"
+    special_time: daily
+    job: "/usr/local/sbin/check-reboot-needed.sh"
+    user: root
+  tags: [patch_mgmt]
+
+- name: Schedule automatic reboot in maintenance window (non-critical systems only)
+  ansible.builtin.cron:
+    name: "Automatic reboot in maintenance window"
+    weekday: "{{ patch_reboot_day }}"
+    hour: "{{ patch_reboot_time.split(':')[0] }}"
+    minute: "{{ patch_reboot_time.split(':')[1] }}"
+    job: "/usr/local/sbin/check-reboot-needed.sh --auto-reboot"
+    user: root
+  when: inventory_hostname in patch_reboot_window_hosts
+  tags: [patch_mgmt]

roles/patch_mgmt/templates/20auto-upgrades.j2

@@ -0,0 +1,5 @@
+// {{ ansible_managed }}
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Download-Upgradeable-Packages "1";
+APT::Periodic::Unattended-Upgrade "{{ '1' if dnf_automatic_apply_security else '0' }}";
+APT::Periodic::AutocleanInterval "7";

roles/patch_mgmt/templates/50unattended-upgrades.j2

@@ -0,0 +1,11 @@
+// {{ ansible_managed }}
+Unattended-Upgrade::Allowed-Origins {
+    "${distro_id}:${distro_codename}-security";
+{% if dnf_automatic_apply_other %}
+    "${distro_id}:${distro_codename}-updates";
+{% endif %}
+};
+Unattended-Upgrade::Remove-Unused-Dependencies "true";
+Unattended-Upgrade::Automatic-Reboot "false";
+Unattended-Upgrade::Mail "root";
+Unattended-Upgrade::MailReport "on-change";

roles/patch_mgmt/templates/automatic.conf.j2

@@ -0,0 +1,17 @@
+# {{ ansible_managed }}
+[commands]
+upgrade_type = {{ 'security' if not dnf_automatic_apply_other else 'default' }}
+random_sleep = 360
+download_updates = yes
+apply_updates = {{ 'yes' if dnf_automatic_apply_security else 'no' }}
+
+[emitters]
+emit_via = stdio
+
+[email]
+email_from = dnf-automatic@{{ ansible_domain | default('example.corp') }}
+email_to = root
+email_host = localhost
+
+[base]
+debuglevel = 1

roles/patch_mgmt/templates/check-reboot-needed.sh.j2

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# {{ ansible_managed }}
+set -euo pipefail
+
+{% if ansible_facts['os_family'] == "RedHat" %}
+reboot_required() {
+    ! /usr/bin/needs-restarting -r >/dev/null 2>&1
+}
+{% else %}
+reboot_required() {
+    test -f /var/run/reboot-required
+}
+{% endif %}
+
+if reboot_required; then
+    logger -t check-reboot-needed "Reboot required on {{ inventory_hostname }} after security update."
+    echo "Reboot required on {{ inventory_hostname }}." | mail -s "Reboot required: {{ inventory_hostname }}" root || true
+
+    if [[ "${1:-}" == "--auto-reboot" ]]; then
+        logger -t check-reboot-needed "Performing automatic reboot (scheduled maintenance window)."
+        /usr/sbin/shutdown -r +1 "Automatic reboot after security update (maintenance window)"
+    fi
+else
+    logger -t check-reboot-needed "No reboot required on {{ inventory_hostname }}."
+fi

roles/patch_mgmt/vars/Debian.yml

@@ -0,0 +1,4 @@
+---
+patch_mgmt_packages:
+  - unattended-upgrades
+  - apt-listchanges

roles/patch_mgmt/vars/RedHat.yml

@@ -0,0 +1,4 @@
+---
+patch_mgmt_packages:
+  - dnf-automatic
+  - dnf-utils