neiam /devendra

# Debian unattended-upgrades (reusable fragment). Debian/apt hosts only —
# include it on Debian boxes, not the openSUSE ones.
#   include = ["include/unattended-upgrades.toml"]
#
# "Modern/correct position":
#   * driven by the systemd apt timers (apt-daily*.timer), not cron;
#   * enabled via /etc/apt/apt.conf.d/20auto-upgrades (what dpkg-reconfigure writes);
#   * our customizations live in 52unattended-upgrades-local, which sorts AFTER
#     the package's 50unattended-upgrades conffile — so we never edit the shipped
#     conffile and dpkg never prompts on upgrade.

[[packages]]
name = "unattended-upgrades"

# Turn the periodic machinery on.
[[files]]
path = "/etc/apt/apt.conf.d/20auto-upgrades"
mode = "0644"
content = """
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::AutocleanInterval "7";
"""

# Local overrides (sort after 50unattended-upgrades, so these win). `#clear`
# replaces the shipped origins list instead of appending to it.
[[files]]
path = "/etc/apt/apt.conf.d/52unattended-upgrades-local"
mode = "0644"
content = """
#clear Unattended-Upgrade::Origins-Pattern;
Unattended-Upgrade::Origins-Pattern {
    // Security (both suite namings, so it works across Debian releases).
    "origin=Debian,codename=${distro_codename},label=Debian-Security";
    "origin=Debian,codename=${distro_codename}-security,label=Debian-Security";
    // Regular stable point updates. Comment this line out for security-only.
    "origin=Debian,codename=${distro_codename}-updates";
};

Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";

// Reboot automatically when an update requires it, at a quiet hour. Set to
// "false" if you'd rather reboot these boxes yourself.
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "04:00";
"""

# The modern drivers: apt-daily.timer refreshes + downloads, apt-daily-upgrade
# .timer runs the unattended upgrade. (Shipped by apt; enabled here explicitly.)
[[services]]
name = "apt-daily.timer"
enabled = true
state = "started"

[[services]]
name = "apt-daily-upgrade.timer"
enabled = true
state = "started"