Clément Désiles
b94743567f
Detect drift between the running kernel and the newest installed one (Arch: /usr/lib/modules vs uname -r; Debian: /var/run/reboot-required) and push a weekly ntfy reminder until the host is rebooted. Also bundles the in-flight ignore-packages feature and hostname refactor in the autoupdate script.
77 lines
2.3 KiB
YAML
77 lines
2.3 KiB
YAML
---
|
|
- name: Validate required configuration
|
|
ansible.builtin.assert:
|
|
that:
|
|
- sys_autoupdate_ntfy_topic is defined
|
|
- sys_autoupdate_ntfy_topic | length > 0
|
|
fail_msg: |
|
|
sys_autoupdate_ntfy_topic is required.
|
|
See roles/sys_autoupdate/defaults/main.yml for configuration.
|
|
|
|
- name: Load OS-specific variables
|
|
ansible.builtin.include_vars: "{{ item }}"
|
|
with_first_found:
|
|
- "{{ ansible_facts['os_family'] }}.yml"
|
|
- debian.yml
|
|
|
|
- name: Install required packages
|
|
ansible.builtin.package:
|
|
name: "{{ sys_autoupdate_packages }}"
|
|
state: present
|
|
|
|
- name: Reconcile apt package holds (Debian/Ubuntu)
|
|
when: ansible_facts['os_family'] == 'Debian'
|
|
block:
|
|
- name: Get currently held apt packages
|
|
ansible.builtin.command: apt-mark showhold
|
|
register: sys_autoupdate_current_holds
|
|
changed_when: false
|
|
|
|
- name: Hold packages listed in sys_autoupdate_ignore_packages
|
|
ansible.builtin.dpkg_selections:
|
|
name: "{{ item }}"
|
|
selection: hold
|
|
loop: "{{ sys_autoupdate_ignore_packages }}"
|
|
when: item not in sys_autoupdate_current_holds.stdout_lines
|
|
|
|
# NOTE: holds set manually (outside this role) or in previous runs are not
|
|
# automatically released when removed from sys_autoupdate_ignore_packages.
|
|
# This is intentional: avoids accidentally unholding operator-pinned packages.
|
|
# To release a hold, run: sudo apt-mark unhold <package>
|
|
|
|
- name: Deploy autoupdate script
|
|
ansible.builtin.template:
|
|
src: sys-autoupdate.sh.j2
|
|
dest: "{{ sys_autoupdate_script_path }}"
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
notify: Restart sys-autoupdate timer
|
|
|
|
- name: Deploy systemd service
|
|
ansible.builtin.template:
|
|
src: sys-autoupdate.service.j2
|
|
dest: /etc/systemd/system/sys-autoupdate.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Restart sys-autoupdate timer
|
|
|
|
- name: Deploy systemd timer
|
|
ansible.builtin.template:
|
|
src: sys-autoupdate.timer.j2
|
|
dest: /etc/systemd/system/sys-autoupdate.timer
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Restart sys-autoupdate timer
|
|
|
|
- name: Flush handlers before enabling timer
|
|
ansible.builtin.meta: flush_handlers
|
|
|
|
- name: Enable and start update timer
|
|
ansible.builtin.systemd:
|
|
name: sys-autoupdate.timer
|
|
enabled: true
|
|
state: started
|