first commit

templates/unattended-upgrades-notify.sh.j2

@@ -0,0 +1,38 @@
+#!/bin/bash
+# Généré par ansible (infra/playbook-unattended-upgrades.yml) — ne pas éditer à la main.
+set -euo pipefail
+
+LOG="/var/log/unattended-upgrades/unattended-upgrades.log"
+TODAY="$(date +%Y-%m-%d)"
+HOSTNAME="$(hostname)"
+WEBHOOK_URL="{{ discord_infra_webhook_url }}"
+
+if [ -z "$WEBHOOK_URL" ]; then
+    exit 0
+fi
+
+INSTALLED=""
+if [ -f "$LOG" ]; then
+    INSTALLED=$(grep "^$TODAY" "$LOG" | grep -i "Packages that will be upgraded\|Packages that are upgraded" || true)
+fi
+
+REBOOT_STATUS="Pas de redémarrage requis"
+if [ -f /var/run/reboot-required ]; then
+    REBOOT_STATUS="⚠️ Redémarrage requis (programmé à 00:00 UTC)"
+fi
+
+if [ -z "$INSTALLED" ]; then
+    MESSAGE="🔒 [$HOSTNAME] Unattended-upgrades — aucun paquet de sécurité à installer aujourd'hui."
+else
+    MESSAGE="🔒 [$HOSTNAME] Unattended-upgrades — paquets mis à jour aujourd'hui :
+${INSTALLED}
+
+${REBOOT_STATUS}"
+fi
+
+PAYLOAD="$(jq -n --arg content "$MESSAGE" '{content: $content}')"
+
+curl -s -X POST "$WEBHOOK_URL" \
+    -H "Content-Type: application/json" \
+    -d "$PAYLOAD" \
+    > /dev/null