You've already forked ansible-linux-infra
91 lines
2.6 KiB
YAML
91 lines
2.6 KiB
YAML
---
|
|
- name: Include OS-family-specific variables
|
|
ansible.builtin.include_vars: "{{ item }}"
|
|
with_first_found:
|
|
- "{{ ansible_facts['os_family'] }}.yml"
|
|
- "default.yml"
|
|
tags: [patch_mgmt, always]
|
|
|
|
- name: Install patch management packages
|
|
ansible.builtin.package:
|
|
name: "{{ patch_mgmt_packages }}"
|
|
state: present
|
|
tags: [patch_mgmt]
|
|
|
|
- name: Deploy dnf-automatic configuration (RedHat family)
|
|
ansible.builtin.template:
|
|
src: automatic.conf.j2
|
|
dest: /etc/dnf/automatic.conf
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
when: ansible_facts['os_family'] == "RedHat"
|
|
tags: [patch_mgmt]
|
|
|
|
- name: Enable dnf-automatic download timer (RedHat family)
|
|
ansible.builtin.systemd:
|
|
name: dnf-automatic.timer
|
|
enabled: true
|
|
state: started
|
|
when: ansible_facts['os_family'] == "RedHat"
|
|
tags: [patch_mgmt]
|
|
|
|
- name: Deploy unattended-upgrades allowed-origins configuration (Debian family)
|
|
ansible.builtin.template:
|
|
src: 50unattended-upgrades.j2
|
|
dest: /etc/apt/apt.conf.d/50unattended-upgrades
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
tags: [patch_mgmt]
|
|
|
|
- name: Deploy apt periodic update/upgrade configuration (Debian family)
|
|
ansible.builtin.template:
|
|
src: 20auto-upgrades.j2
|
|
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
tags: [patch_mgmt]
|
|
|
|
- name: Enable apt-daily timers (Debian family)
|
|
ansible.builtin.systemd:
|
|
name: "{{ item }}"
|
|
enabled: true
|
|
state: started
|
|
loop:
|
|
- apt-daily.timer
|
|
- apt-daily-upgrade.timer
|
|
when: ansible_facts['os_family'] == "Debian"
|
|
tags: [patch_mgmt]
|
|
|
|
- name: Deploy reboot-required check script
|
|
ansible.builtin.template:
|
|
src: check-reboot-needed.sh.j2
|
|
dest: /usr/local/sbin/check-reboot-needed.sh
|
|
owner: root
|
|
group: root
|
|
mode: "0750"
|
|
tags: [patch_mgmt]
|
|
|
|
- name: Schedule daily reboot-required check
|
|
ansible.builtin.cron:
|
|
name: "Check for pending reboot after patching"
|
|
special_time: daily
|
|
job: "/usr/local/sbin/check-reboot-needed.sh"
|
|
user: root
|
|
tags: [patch_mgmt]
|
|
|
|
- name: Schedule automatic reboot in maintenance window (non-critical systems only)
|
|
ansible.builtin.cron:
|
|
name: "Automatic reboot in maintenance window"
|
|
weekday: "{{ patch_reboot_day }}"
|
|
hour: "{{ patch_reboot_time.split(':')[0] }}"
|
|
minute: "{{ patch_reboot_time.split(':')[1] }}"
|
|
job: "/usr/local/sbin/check-reboot-needed.sh --auto-reboot"
|
|
user: root
|
|
when: inventory_hostname in patch_reboot_window_hosts
|
|
tags: [patch_mgmt]
|