- name: Set up automatic security updates via yum-cron
  block:
    - name: Ensures cron(ie) installed
      yum: name=cronie state=present
      tags: cronie

    - name: Ensures cron(ie) service is running
      service: name=crond state=started enabled=yes
      tags: cronie

    - name: Ensures yum-cron installed
      yum: name=yum-cron state=present
      tags: yum-cron

    - name: Configure yum-cron.conf
      template: src=yum-cron.conf.j2 dest=/etc/yum/yum-cron.conf
      notify: restart yum-cron
      tags: yum-cron

    - name: Configure yum-cron-hourly.conf
      template: src=yum-cron-hourly.conf.j2 dest=/etc/yum/yum-cron-hourly.conf
      notify: restart yum-cron
      tags: yum-cron

    - name: Ensures yum-cron service is running
      service: name=yum-cron state=started enabled=yes
      tags: yum-cron

    - name: Configure yum-cron-clean to run a yum clean regularly
      template: src=yum_clean_cron.j2 dest=/etc/cron.{{ yum_cron_clean_when }}/yum_clean_cron mode=0755
      when: yum_cron_clean_enabled|bool == true

    - name: Remove the yum-cron-clean files if disabled
      file:
        path: /etc/cron.{{ item }}/yum_clean_cron
        state: absent
      with_items:
        - daily
        - hourly
        - weekly
        - monthly
      when: yum_cron_clean_enabled|bool == false
    - name: Enable reboot if there are pending updates
      ansible.builtin.cron:
        name: "Enable reboot if there are pending updates"
        minute: '{{ yum_cron_reboot_minute }}'
        hour: '{{ yum_cron_reboot_hour }}'
        job: "/usr/bin/needs-restarting -r || /usr/sbin/shutdown -r"
        user: root
        state: present
      become: true
      when: yum_cron_reboot_enabled == true
    - name: Disable reboot if there are pending updates
      ansible.builtin.cron:
        name: "Enable reboot if there are pending updates"
        minute: '{{ yum_cron_reboot_minute }}'
        hour: '{{ yum_cron_reboot_hour }}'
        job: "/usr/bin/needs-restarting -r || /usr/sbin/shutdown -r"
        user: root
        state: absent
      become: true
      when: yum_cron_reboot_enabled == false
    - name: Set kernel retention
      ansible.builtin.lineinfile:
        path: /etc/yum.conf
        line: installonly_limit={{ yum_kernel_retention }}
  when: ansible_pkg_mgr == "yum" and not ansible_check_mode