{"id":16362456,"url":"https://github.com/petemcw/ansible-role-security-updates","last_synced_at":"2025-10-26T05:31:08.608Z","repository":{"id":58385228,"uuid":"80247947","full_name":"petemcw/ansible-role-security-updates","owner":"petemcw","description":"Automatic Security Updates Role for Ansible","archived":false,"fork":false,"pushed_at":"2022-09-12T08:41:38.000Z","size":9,"stargazers_count":3,"open_issues_count":1,"forks_count":4,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-01-31T15:53:34.453Z","etag":null,"topics":["ansible","ansible-role","security","unattended-upgrades","yum-cron"],"latest_commit_sha":null,"homepage":null,"language":null,"has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/petemcw.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2017-01-27T21:33:48.000Z","updated_at":"2023-05-31T09:44:43.000Z","dependencies_parsed_at":"2023-01-18T04:30:48.258Z","dependency_job_id":null,"html_url":"https://github.com/petemcw/ansible-role-security-updates","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/petemcw%2Fansible-role-security-updates","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/petemcw%2Fansible-role-security-updates/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/petemcw%2Fansible-role-security-updates/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/petemcw%2Fansible-role-security-updates/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/petemcw","download_url":"https://codeload.github.com/petemcw/ansible-role-security-updates/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":238264760,"owners_count":19443405,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ansible","ansible-role","security","unattended-upgrades","yum-cron"],"created_at":"2024-10-11T02:24:19.018Z","updated_at":"2025-10-26T05:31:03.305Z","avatar_url":"https://github.com/petemcw.png","language":null,"funding_links":[],"categories":[],"sub_categories":[],"readme":"# Automatic Security Updates Role for Ansible\n\n[![Build Status](https://travis-ci.org/petemcw/ansible-role-security-updates.svg?branch=master)](https://travis-ci.org/petemcw/ansible-role-security-updates)\n\nUsing this role install and setup automatic updates for Debian and RedHat families, to periodically install security upgrades. On Debian/Ubuntu the `unattended-upgrades` package is used and RedHat/CentOS uses `yum-cron`.\n\n## Role Variables\n\nThe variables that can be passed to this role and a brief description about\nthem are as follows:\n\n```yaml\n# Enable automatic updates\nsecurity_updates_enabled: true\n\n# An array of origins patterns to determine whether the package can be automatically installed\nsecurity_updates_apt_origins_patterns: []\n\n# Packages which won't be automatically upgraded\nsecurity_updates_apt_package_blacklist: []\n\n# Whether to attempt a recover on unclean dpkg exit\nsecurity_updates_apt_autofix_interrupted_dpkg: true\n\n# Split the upgrade into the smallest possible chunks so that they can be interrupted with SIGUSR1\nsecurity_updates_apt_minimal_steps: false\n\n# Install all unattended-upgrades when the machine is shutting down\nsecurity_updates_apt_install_on_shutdown: false\n\n# Send information about upgrades or problems with unattended upgrades\nsecurity_updates_apt_mail: false\n\n# E-mail address to send information about upgrades or problems with unattended upgrades\nsecurity_updates_apt_mail_address: \"root@localhost\"\n\n# Send e-mail only on errors, otherwise e-mail will be sent every time there's a package upgrade\nsecurity_updates_apt_mail_only_on_error: false\n\n# Do automatic removal of new unused dependencies after the upgrade\nsecurity_updates_apt_remove_unused_dependencies: false\n\n# Automatically reboot system if any upgraded package requires it, immediately after the upgrade\nsecurity_updates_apt_automatic_reboot: false\n\n# Automatically reboot system if any upgraded package requires it, at the specific time (HH:MM) instead of immediately after the upgrade\nsecurity_updates_apt_automatic_reboot_time: false\n\n# Won't automatically upgrade some critical packages requiring restart after an upgrade, this forces it\nsecurity_updates_apt_ignore_apps_require_restart: false\n\n# Only allocate certain amount of bandwidth for updates\nsecurity_updates_apt_dl_limit: 70\n\n# Type of packages to update:\n# default\n# security\n# security-severity:critical\n# minimal\n# minimal-security\n# minimal-security-severity:critical\nsecurity_updates_yum_update_cmd: \"security\"\n\n# Whether a message should be emitted when updates are available\nsecurity_updates_yum_update_messages: \"yes\"\n\n# Whether updates should be downloaded when they are available\nsecurity_updates_yum_download_updates: \"yes\"\n\n# Whether updates should be applied when they are available; download must also be \"yes\" for updates to be applied\nsecurity_updates_yum_apply_updates: \"false\"\n\n# Maximum amout of time to randomly sleep, in minutes\nsecurity_updates_yum_random_sleep: 360\n\n# Name to use for this system in messages that are emitted\nsecurity_updates_yum_system_name: \"None\"\n\n# How to send messages.  Valid options are `stdio` and `email`\nsecurity_updates_yum_emit_via: \"stdio\"\n\n# The width, in characters, that messages that are emitted should be formatted\nsecurity_updates_yum_output_width: 80\n\n# The address to send email messages from\nsecurity_updates_yum_email_from: \"root@localhost\"\n\n# List of addresses to send messages to\nsecurity_updates_yum_email_to: \"root\"\n\n# Name of the host to connect to to send email messages\nsecurity_updates_yum_email_host: \"localhost\"\n\n# List of groups to update\nsecurity_updates_yum_group_list: \"None\"\n\n# The types of group packages to install\nsecurity_updates_yum_group_package_types:\n  - mandatory\n  - default\n\n# Use this to filter Yum core messages\n# -4: critical\n# -3: critical+errors\n# -2: critical+errors+warnings\nsecurity_updates_yum_debuglevel: -2\n\nsecurity_updates_yum_mdpolicy: \"group:main\"\n```\n\n## Examples\n\n1. Configure the security updates with the defaults:\n\n    ```yaml\n    ---\n    # This playbook configures automatic security updates\n\n    - name: Configure security updates on all nodes\n      hosts: all\n      roles:\n        - security-updates\n    ```\n\n## Dependencies\n\nNone.\n\n## License\n\nMIT\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpetemcw%2Fansible-role-security-updates","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fpetemcw%2Fansible-role-security-updates","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fpetemcw%2Fansible-role-security-updates/lists"}