From e54c9bc8d96bdef1c9a5634f5cff3b66f38f487e Mon Sep 17 00:00:00 2001 From: Guilhem Moulin Date: Wed, 30 Oct 2013 21:03:16 +0100 Subject: Configure APT. --- roles/common/files/etc/apt/apt.conf.d/10periodic | 4 ++ .../files/etc/apt/apt.conf.d/50unattended-upgrades | 60 ++++++++++++++++++++++ roles/common/files/etc/apt/listchanges.conf | 6 +++ roles/common/handlers/main.yml | 3 ++ roles/common/tasks/apt.yml | 36 +++++++++++++ roles/common/tasks/main.yml | 1 + roles/common/templates/etc/apt/preferences.j2 | 14 +++++ roles/common/templates/etc/apt/sources.list.j2 | 16 ++++++ 8 files changed, 140 insertions(+) create mode 100644 roles/common/files/etc/apt/apt.conf.d/10periodic create mode 100644 roles/common/files/etc/apt/apt.conf.d/50unattended-upgrades create mode 100644 roles/common/files/etc/apt/listchanges.conf create mode 100644 roles/common/tasks/apt.yml create mode 100644 roles/common/templates/etc/apt/preferences.j2 create mode 100644 roles/common/templates/etc/apt/sources.list.j2 diff --git a/roles/common/files/etc/apt/apt.conf.d/10periodic b/roles/common/files/etc/apt/apt.conf.d/10periodic new file mode 100644 index 0000000..234a878 --- /dev/null +++ b/roles/common/files/etc/apt/apt.conf.d/10periodic @@ -0,0 +1,4 @@ +APT::Periodic::Update-Package-Lists "1"; +APT::Periodic::Download-Upgradeable-Packages "1"; +APT::Periodic::AutocleanInterval "1"; +APT::Periodic::Unattended-Upgrade "1"; diff --git a/roles/common/files/etc/apt/apt.conf.d/50unattended-upgrades b/roles/common/files/etc/apt/apt.conf.d/50unattended-upgrades new file mode 100644 index 0000000..8d30e3e --- /dev/null +++ b/roles/common/files/etc/apt/apt.conf.d/50unattended-upgrades @@ -0,0 +1,60 @@ +// Automatically upgrade packages from these origin patterns +Unattended-Upgrade::Origins-Pattern { + // Archive or Suite based matching: + // Note that this will silently match a different release after + // migration to the specified archive (e.g. testing becomes the + // new stable). + "o=${distro_id},a=${distro_codename}"; +// "o=${distro_id},a=${distro_codename}-updates"; +// "o=${distro_id},a=proposed-updates"; + "o=${distro_id},a=${distro_codename},l=Debian-Security"; +}; + +// List of packages to not update +Unattended-Upgrade::Package-Blacklist { +// "vim"; +// "libc6"; +// "libc6-dev"; +// "libc6-i686"; +}; + + +// This option allows you to control if on a unclean dpkg exit +// unattended-upgrades will automatically run +// dpkg --force-confold --configure -a +// The default is true, to ensure updates keep getting installed +//Unattended-Upgrade::AutoFixInterruptedDpkg "false"; + +// Split the upgrade into the smallest possible chunks so that +// they can be interrupted with SIGUSR1. This makes the upgrade +// a bit slower but it has the benefit that shutdown while a upgrade +// is running is possible (with a small delay) +//Unattended-Upgrade::MinimalSteps "true"; + +// Install all unattended-upgrades when the machine is shuting down +// instead of doing it in the background while the machine is running +// This will (obviously) make shutdown slower +//Unattended-Upgrade::InstallOnShutdown "true"; + +// Send email to this address for problems or packages upgrades +// If empty or unset then no email is sent, make sure that you +// have a working mail setup on your system. A package that provides +// 'mailx' must be installed. E.g. "user@example.com" +Unattended-Upgrade::Mail "admin@fripost.org"; + +// Set this value to "true" to get emails only on errors. Default +// is to always send a mail if Unattended-Upgrade::Mail is set +//Unattended-Upgrade::MailOnlyOnError "true"; + +// Do automatic removal of new unused dependencies after the upgrade +// (equivalent to apt-get autoremove) +//Unattended-Upgrade::Remove-Unused-Dependencies "false"; + +// Automatically reboot *WITHOUT CONFIRMATION* if a +// the file /var/run/reboot-required is found after the upgrade +Unattended-Upgrade::Automatic-Reboot "false"; + + +// Use apt bandwidth limit feature, this example limits the download +// speed to 128kb/sec +Acquire::http::Dl-Limit "128"; diff --git a/roles/common/files/etc/apt/listchanges.conf b/roles/common/files/etc/apt/listchanges.conf new file mode 100644 index 0000000..dc31f5e --- /dev/null +++ b/roles/common/files/etc/apt/listchanges.conf @@ -0,0 +1,6 @@ +[apt] +frontend=mail +email_address=admin@fripost.org +confirm=0 +save_seen=/var/lib/apt/listchanges.db +which=news diff --git a/roles/common/handlers/main.yml b/roles/common/handlers/main.yml index e42534c..c1f9137 100644 --- a/roles/common/handlers/main.yml +++ b/roles/common/handlers/main.yml @@ -1,3 +1,6 @@ --- - name: Refresh hostname service: name=hostname.sh state=restarted + +- name: apt-get update + apt: update_cache=yes diff --git a/roles/common/tasks/apt.yml b/roles/common/tasks/apt.yml new file mode 100644 index 0000000..9b553b0 --- /dev/null +++ b/roles/common/tasks/apt.yml @@ -0,0 +1,36 @@ +- name: Install various APT tools + apt: pkg={{ item }} + with_items: + - apt + - apt-listbugs + - apt-listchanges + - apt-show-versions + - debian-archive-keyring + - debian-goodies + - unattended-upgrades + - debfoster + - deborphan + - debsecan + - debsums + - update-notifier-common + +- name: Configure APT (1) + template: src=etc/apt/{{ item }}.j2 + dest=/etc/apt/{{ item }} + owner=root group=root + mode=0644 + with_items: + - sources.list + - preferences + notify: + - apt-get update + +- name: Configure APT (2) + copy: src=etc/apt/{{ item }} + dest=/etc/apt/{{ item }} + owner=root group=root + mode=0644 + with_items: + - listchanges.conf + - apt.conf.d/10periodic + - apt.conf.d/50unattended-upgrades diff --git a/roles/common/tasks/main.yml b/roles/common/tasks/main.yml index 1abcbb6..d6a4266 100644 --- a/roles/common/tasks/main.yml +++ b/roles/common/tasks/main.yml @@ -1,3 +1,4 @@ --- - include: sysctl.yml tags=sysctl - include: hosts.yml +- include: apt.yml tags=apt diff --git a/roles/common/templates/etc/apt/preferences.j2 b/roles/common/templates/etc/apt/preferences.j2 new file mode 100644 index 0000000..6a715b5 --- /dev/null +++ b/roles/common/templates/etc/apt/preferences.j2 @@ -0,0 +1,14 @@ +# {{ ansible_managed }} +# Do NOT edit this file directly! + +# Install updates as soon as they're available +Package: * +Pin: release a={{ ansible_lsb.codename }}-updates +Pin-Priority: 990 + +{% if 'backports' in group_names -%} +# Install automatically new versions from backports +Package: * +Pin: release a={{ ansible_lsb.codename }}-backports +Pin-Priority: 200 +{% endif %} diff --git a/roles/common/templates/etc/apt/sources.list.j2 b/roles/common/templates/etc/apt/sources.list.j2 new file mode 100644 index 0000000..b2c30d0 --- /dev/null +++ b/roles/common/templates/etc/apt/sources.list.j2 @@ -0,0 +1,16 @@ +# {{ ansible_managed }} +# Do NOT edit this file directly! + +deb http://ftp.se.debian.org/debian/ {{ ansible_lsb.codename }} main +deb-src http://ftp.se.debian.org/debian/ {{ ansible_lsb.codename }} main + +deb http://security.debian.org/ {{ ansible_lsb.codename }}/updates main +deb-src http://security.debian.org/ {{ ansible_lsb.codename }}/updates main + +deb http://ftp.se.debian.org/debian/ {{ ansible_lsb.codename }}-updates main +deb-src http://ftp.se.debian.org/debian/ {{ ansible_lsb.codename }}-updates main + +{% if 'backports' in group_names -%} +deb http://ftp.debian.org/debian/ {{ ansible_lsb.codename }}-backports main +deb-src http://ftp.debian.org/debian/ {{ ansible_lsb.codename }}-backports main +{% endif %} -- cgit v1.2.3