initial commit

roles/patch_mgmt/templates/20auto-upgrades.j2

@@ -0,0 +1,5 @@
+// {{ ansible_managed }}
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Download-Upgradeable-Packages "1";
+APT::Periodic::Unattended-Upgrade "{{ '1' if dnf_automatic_apply_security else '0' }}";
+APT::Periodic::AutocleanInterval "7";

roles/patch_mgmt/templates/50unattended-upgrades.j2

@@ -0,0 +1,11 @@
+// {{ ansible_managed }}
+Unattended-Upgrade::Allowed-Origins {
+    "${distro_id}:${distro_codename}-security";
+{% if dnf_automatic_apply_other %}
+    "${distro_id}:${distro_codename}-updates";
+{% endif %}
+};
+Unattended-Upgrade::Remove-Unused-Dependencies "true";
+Unattended-Upgrade::Automatic-Reboot "false";
+Unattended-Upgrade::Mail "root";
+Unattended-Upgrade::MailReport "on-change";

roles/patch_mgmt/templates/automatic.conf.j2

@@ -0,0 +1,17 @@
+# {{ ansible_managed }}
+[commands]
+upgrade_type = {{ 'security' if not dnf_automatic_apply_other else 'default' }}
+random_sleep = 360
+download_updates = yes
+apply_updates = {{ 'yes' if dnf_automatic_apply_security else 'no' }}
+
+[emitters]
+emit_via = stdio
+
+[email]
+email_from = dnf-automatic@{{ ansible_domain | default('example.corp') }}
+email_to = root
+email_host = localhost
+
+[base]
+debuglevel = 1

roles/patch_mgmt/templates/check-reboot-needed.sh.j2

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# {{ ansible_managed }}
+set -euo pipefail
+
+{% if ansible_facts['os_family'] == "RedHat" %}
+reboot_required() {
+    ! /usr/bin/needs-restarting -r >/dev/null 2>&1
+}
+{% else %}
+reboot_required() {
+    test -f /var/run/reboot-required
+}
+{% endif %}
+
+if reboot_required; then
+    logger -t check-reboot-needed "Reboot required on {{ inventory_hostname }} after security update."
+    echo "Reboot required on {{ inventory_hostname }}." | mail -s "Reboot required: {{ inventory_hostname }}" root || true
+
+    if [[ "${1:-}" == "--auto-reboot" ]]; then
+        logger -t check-reboot-needed "Performing automatic reboot (scheduled maintenance window)."
+        /usr/sbin/shutdown -r +1 "Automatic reboot after security update (maintenance window)"
+    fi
+else
+    logger -t check-reboot-needed "No reboot required on {{ inventory_hostname }}."
+fi