78 lines
2.5 KiB
YAML
78 lines
2.5 KiB
YAML
---
|
|
- name: Mises à jour de sécurité automatiques (unattended-upgrades)
|
|
hosts: load-balancer
|
|
become: true
|
|
|
|
tasks:
|
|
- name: Installer unattended-upgrades et jq (notification Discord)
|
|
ansible.builtin.apt:
|
|
name:
|
|
- unattended-upgrades
|
|
- jq
|
|
state: present
|
|
update_cache: true
|
|
|
|
- name: Déployer la config des origines/exclusions (50unattended-upgrades)
|
|
ansible.builtin.template:
|
|
src: ../templates/unattended-upgrades-50.j2
|
|
dest: /etc/apt/apt.conf.d/50unattended-upgrades
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Déployer la config d'activation périodique (20auto-upgrades)
|
|
ansible.builtin.template:
|
|
src: ../templates/unattended-upgrades-20.j2
|
|
dest: /etc/apt/apt.conf.d/20auto-upgrades
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
|
|
- name: Déployer le script de notification Discord
|
|
ansible.builtin.template:
|
|
src: ../templates/unattended-upgrades-notify.sh.j2
|
|
dest: /usr/local/bin/unattended-upgrades-notify.sh
|
|
owner: root
|
|
group: root
|
|
mode: "0750"
|
|
|
|
- name: Déployer le service systemd de notification
|
|
ansible.builtin.template:
|
|
src: ../templates/unattended-upgrades-notify.service.j2
|
|
dest: /etc/systemd/system/unattended-upgrades-notify.service
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Recharger systemd
|
|
|
|
- name: Déployer le timer systemd de notification
|
|
ansible.builtin.template:
|
|
src: ../templates/unattended-upgrades-notify.timer.j2
|
|
dest: /etc/systemd/system/unattended-upgrades-notify.timer
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Recharger systemd
|
|
|
|
- name: Activer et démarrer le timer de notification
|
|
ansible.builtin.systemd:
|
|
name: unattended-upgrades-notify.timer
|
|
enabled: true
|
|
state: started
|
|
daemon_reload: true
|
|
|
|
- name: Vérifier la config avec un dry-run
|
|
ansible.builtin.command: unattended-upgrade --dry-run --debug
|
|
register: dry_run_result
|
|
changed_when: false
|
|
failed_when: false
|
|
|
|
- name: Afficher le résultat du dry-run
|
|
ansible.builtin.debug:
|
|
var: dry_run_result.stdout_lines
|
|
|
|
handlers:
|
|
- name: Recharger systemd
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|