---
- name: add distribution-specific variables
  ansible.builtin.include_vars: "{{ lookup('first_found', params) }}"
  vars:
    params:
      files:
        - '{{ ansible_distribution }}-{{ ansible_distribution_major_version }}.yml'   # yamllint disable-line rule:line-length
        - '{{ ansible_distribution }}.yml'
      paths:
        - 'vars'
  tags:
    - unattended_upgrades
    - unattended_upgrades.include_dist_vars

- name: install unattended upgrades packages
  ansible.builtin.apt:
    name: "{{ unattended_upgrades_packages }}"
    state: present
    update_cache: true
    cache_valid_time: "{{ unattended_upgrades_cache_valid_time }}"
  loop_control:
    loop_var: unattended_upgrades_packages
  with_items:
    - apt-listchanges
    - unattended-upgrades
  tags:
    - unattended_upgrades
    - unattended_upgrades.packages

# Ignored, since newer distros don't need this package
- name: install update-notifier-common
  ansible.builtin.apt:
    name: update-notifier-common
    state: present
  failed_when: false
  tags:
    - unattended_upgrades
    - unattended_upgrades.packages

- name: create APT auto-upgrades configuration
  ansible.builtin.template:
    src: auto-upgrades.j2
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    owner: root
    group: root
    mode: 0644
  notify: restart unattended-upgrades service
  tags:
    - unattended_upgrades
    - unattended_upgrades.auto_upgrades_config

- name: create unattended-upgrades configuration
  ansible.builtin.template:
    src: unattended-upgrades.j2
    dest: /etc/apt/apt.conf.d/50unattended-upgrades
    owner: root
    group: root
    mode: 0644
  notify: restart unattended-upgrades service
  tags:
    - unattended_upgrades
    - unattended_upgrades.unattended_upgrades_config

- name: enable and start unattended-upgrades service
  ansible.builtin.service:
    name: unattended-upgrades
    enabled: true
    state: started
  tags:
    - unattended_upgrades
    - unattended_upgrades.service
...