initial commit

roles/patch_mgmt/tasks/main.yml

@@ -0,0 +1,90 @@
+---
+- name: Include OS-family-specific variables
+  ansible.builtin.include_vars: "{{ item }}"
+  with_first_found:
+    - "{{ ansible_facts['os_family'] }}.yml"
+    - "default.yml"
+  tags: [patch_mgmt, always]
+
+- name: Install patch management packages
+  ansible.builtin.package:
+    name: "{{ patch_mgmt_packages }}"
+    state: present
+  tags: [patch_mgmt]
+
+- name: Deploy dnf-automatic configuration (RedHat family)
+  ansible.builtin.template:
+    src: automatic.conf.j2
+    dest: /etc/dnf/automatic.conf
+    owner: root
+    group: root
+    mode: "0644"
+  when: ansible_facts['os_family'] == "RedHat"
+  tags: [patch_mgmt]
+
+- name: Enable dnf-automatic download timer (RedHat family)
+  ansible.builtin.systemd:
+    name: dnf-automatic.timer
+    enabled: true
+    state: started
+  when: ansible_facts['os_family'] == "RedHat"
+  tags: [patch_mgmt]
+
+- name: Deploy unattended-upgrades allowed-origins configuration (Debian family)
+  ansible.builtin.template:
+    src: 50unattended-upgrades.j2
+    dest: /etc/apt/apt.conf.d/50unattended-upgrades
+    owner: root
+    group: root
+    mode: "0644"
+  when: ansible_facts['os_family'] == "Debian"
+  tags: [patch_mgmt]
+
+- name: Deploy apt periodic update/upgrade configuration (Debian family)
+  ansible.builtin.template:
+    src: 20auto-upgrades.j2
+    dest: /etc/apt/apt.conf.d/20auto-upgrades
+    owner: root
+    group: root
+    mode: "0644"
+  when: ansible_facts['os_family'] == "Debian"
+  tags: [patch_mgmt]
+
+- name: Enable apt-daily timers (Debian family)
+  ansible.builtin.systemd:
+    name: "{{ item }}"
+    enabled: true
+    state: started
+  loop:
+    - apt-daily.timer
+    - apt-daily-upgrade.timer
+  when: ansible_facts['os_family'] == "Debian"
+  tags: [patch_mgmt]
+
+- name: Deploy reboot-required check script
+  ansible.builtin.template:
+    src: check-reboot-needed.sh.j2
+    dest: /usr/local/sbin/check-reboot-needed.sh
+    owner: root
+    group: root
+    mode: "0750"
+  tags: [patch_mgmt]
+
+- name: Schedule daily reboot-required check
+  ansible.builtin.cron:
+    name: "Check for pending reboot after patching"
+    special_time: daily
+    job: "/usr/local/sbin/check-reboot-needed.sh"
+    user: root
+  tags: [patch_mgmt]
+
+- name: Schedule automatic reboot in maintenance window (non-critical systems only)
+  ansible.builtin.cron:
+    name: "Automatic reboot in maintenance window"
+    weekday: "{{ patch_reboot_day }}"
+    hour: "{{ patch_reboot_time.split(':')[0] }}"
+    minute: "{{ patch_reboot_time.split(':')[1] }}"
+    job: "/usr/local/sbin/check-reboot-needed.sh --auto-reboot"
+    user: root
+  when: inventory_hostname in patch_reboot_window_hosts
+  tags: [patch_mgmt]