---
- name: Include OS-family-specific variables
  ansible.builtin.include_vars: "{{ item }}"
  with_first_found:
    - "{{ ansible_facts['os_family'] }}.yml"
    - "default.yml"
  tags: [patch_mgmt, always]

- name: Install patch management packages
  ansible.builtin.package:
    name: "{{ patch_mgmt_packages }}"
    state: present
  tags: [patch_mgmt]

- name: Deploy dnf-automatic configuration (RedHat family)
  ansible.builtin.template:
    src: automatic.conf.j2
    dest: /etc/dnf/automatic.conf
    owner: root
    group: root
    mode: "0644"
  when: ansible_facts['os_family'] == "RedHat"
  tags: [patch_mgmt]

- name: Enable dnf-automatic download timer (RedHat family)
  ansible.builtin.systemd:
    name: dnf-automatic.timer
    enabled: true
    state: started
  when: ansible_facts['os_family'] == "RedHat"
  tags: [patch_mgmt]

- name: Deploy unattended-upgrades allowed-origins configuration (Debian family)
  ansible.builtin.template:
    src: 50unattended-upgrades.j2
    dest: /etc/apt/apt.conf.d/50unattended-upgrades
    owner: root
    group: root
    mode: "0644"
  when: ansible_facts['os_family'] == "Debian"
  tags: [patch_mgmt]

- name: Deploy apt periodic update/upgrade configuration (Debian family)
  ansible.builtin.template:
    src: 20auto-upgrades.j2
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    owner: root
    group: root
    mode: "0644"
  when: ansible_facts['os_family'] == "Debian"
  tags: [patch_mgmt]

- name: Enable apt-daily timers (Debian family)
  ansible.builtin.systemd:
    name: "{{ item }}"
    enabled: true
    state: started
  loop:
    - apt-daily.timer
    - apt-daily-upgrade.timer
  when: ansible_facts['os_family'] == "Debian"
  tags: [patch_mgmt]

- name: Deploy reboot-required check script
  ansible.builtin.template:
    src: check-reboot-needed.sh.j2
    dest: /usr/local/sbin/check-reboot-needed.sh
    owner: root
    group: root
    mode: "0750"
  tags: [patch_mgmt]

- name: Schedule daily reboot-required check
  ansible.builtin.cron:
    name: "Check for pending reboot after patching"
    special_time: daily
    job: "/usr/local/sbin/check-reboot-needed.sh"
    user: root
  tags: [patch_mgmt]

- name: Schedule automatic reboot in maintenance window (non-critical systems only)
  ansible.builtin.cron:
    name: "Automatic reboot in maintenance window"
    weekday: "{{ patch_reboot_day }}"
    hour: "{{ patch_reboot_time.split(':')[0] }}"
    minute: "{{ patch_reboot_time.split(':')[1] }}"
    job: "/usr/local/sbin/check-reboot-needed.sh --auto-reboot"
    user: root
  when: inventory_hostname in patch_reboot_window_hosts
  tags: [patch_mgmt]