first commit

infra/playbook-unattended-upgrades.yml

@@ -0,0 +1,77 @@
+---
+- name: Mises à jour de sécurité automatiques (unattended-upgrades)
+  hosts: load-balancer
+  become: true
+
+  tasks:
+      - name: Installer unattended-upgrades et jq (notification Discord)
+        ansible.builtin.apt:
+            name:
+                - unattended-upgrades
+                - jq
+            state: present
+            update_cache: true
+
+      - name: Déployer la config des origines/exclusions (50unattended-upgrades)
+        ansible.builtin.template:
+            src: ../templates/unattended-upgrades-50.j2
+            dest: /etc/apt/apt.conf.d/50unattended-upgrades
+            owner: root
+            group: root
+            mode: "0644"
+
+      - name: Déployer la config d'activation périodique (20auto-upgrades)
+        ansible.builtin.template:
+            src: ../templates/unattended-upgrades-20.j2
+            dest: /etc/apt/apt.conf.d/20auto-upgrades
+            owner: root
+            group: root
+            mode: "0644"
+
+      - name: Déployer le script de notification Discord
+        ansible.builtin.template:
+            src: ../templates/unattended-upgrades-notify.sh.j2
+            dest: /usr/local/bin/unattended-upgrades-notify.sh
+            owner: root
+            group: root
+            mode: "0750"
+
+      - name: Déployer le service systemd de notification
+        ansible.builtin.template:
+            src: ../templates/unattended-upgrades-notify.service.j2
+            dest: /etc/systemd/system/unattended-upgrades-notify.service
+            owner: root
+            group: root
+            mode: "0644"
+        notify: Recharger systemd
+
+      - name: Déployer le timer systemd de notification
+        ansible.builtin.template:
+            src: ../templates/unattended-upgrades-notify.timer.j2
+            dest: /etc/systemd/system/unattended-upgrades-notify.timer
+            owner: root
+            group: root
+            mode: "0644"
+        notify: Recharger systemd
+
+      - name: Activer et démarrer le timer de notification
+        ansible.builtin.systemd:
+            name: unattended-upgrades-notify.timer
+            enabled: true
+            state: started
+            daemon_reload: true
+
+      - name: Vérifier la config avec un dry-run
+        ansible.builtin.command: unattended-upgrade --dry-run --debug
+        register: dry_run_result
+        changed_when: false
+        failed_when: false
+
+      - name: Afficher le résultat du dry-run
+        ansible.builtin.debug:
+            var: dry_run_result.stdout_lines
+
+  handlers:
+      - name: Recharger systemd
+        ansible.builtin.systemd:
+            daemon_reload: true