ansible-role-security
ansible-role-security copied to clipboard
Make upgrades more configurable
I would only want to run upgrades once a week hence my 50periodic
would look like this:
APT::Periodic::Update-Package-Lists "7";
APT::Periodic::Download-Upgradeable-Packages "7";
APT::Periodic::AutocleanInterval "7";
APT::Periodic::Unattended-Upgrade "7";
If I run multiple nodes and I have set restart to true I wouldn't want to have all nodes restarting at the same time so my overrides.conf
at /etc/systemd/system/apt-daily-upgrade.timer.d/override.conf
would look like this
[Timer]
OnCalendar=
OnCalendar=Sun *-*-* 04:00:00
# if multiple nodes are running, add a random delay to avoid all nodes
# running upgrades at the same time (in case restart is enabled)
RandomizedDelaySec=1h
Furthermore what if I only want to run security updates meaning my 50unattended-upgrades
will look like the following
Unattended-Upgrade::Origins-Pattern {
"origin=Debian,codename=${distro_codename},label=Debian-Security";
"origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
};
Given the number of configuration options I would perhaps recommend copying in files. files of which the path the user can define.