initial commit

roles/patch_mgmt/templates/check-reboot-needed.sh.j2

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+# {{ ansible_managed }}
+set -euo pipefail
+
+{% if ansible_facts['os_family'] == "RedHat" %}
+reboot_required() {
+    ! /usr/bin/needs-restarting -r >/dev/null 2>&1
+}
+{% else %}
+reboot_required() {
+    test -f /var/run/reboot-required
+}
+{% endif %}
+
+if reboot_required; then
+    logger -t check-reboot-needed "Reboot required on {{ inventory_hostname }} after security update."
+    echo "Reboot required on {{ inventory_hostname }}." | mail -s "Reboot required: {{ inventory_hostname }}" root || true
+
+    if [[ "${1:-}" == "--auto-reboot" ]]; then
+        logger -t check-reboot-needed "Performing automatic reboot (scheduled maintenance window)."
+        /usr/sbin/shutdown -r +1 "Automatic reboot after security update (maintenance window)"
+    fi
+else
+    logger -t check-reboot-needed "No reboot required on {{ inventory_hostname }}."
+fi