rpi-base: role-owned netplan replaces wpa_supplicant; auto-upgrades gain -updates and 04:00 reboot

Networking: one 40-net.yaml (eth0 always, wifi via rpi_base_wifi_*) with
cloud-init's 50-cloud-init.yaml deleted after first boot. cloud-init still
renders it on an instance_id bump, and it sorts later, so editing the
card's network-config and bumping meta-data is the headless rescue path.
ssh_deletekeys off so a rescue bump keeps the host keys.

Auto-updates: periodic switches and local policy merged into one
52unattended-upgrades-local; 50unattended-upgrades stays a distro
conffile and debconf's 20auto-upgrades can no longer disable anything.

3 files changed, 24 insertions, 4 deletions

diff --git a/rpi-base/files/10-rpi-base.cfg b/rpi-base/files/10-rpi-base.cfg
new file mode 100644
index 0000000..7ce3927
--- /dev/null
+++ b/rpi-base/files/10-rpi-base.cfg
@@ -0,0 +1,4 @@
+# Ansible managed (rpi-base). A rescue instance_id bump re-runs the
+# cloud-init ssh module, which by default deletes and regenerates the
+# ssh host keys on a new instance; keep them.
+ssh_deletekeys: false
diff --git a/rpi-base/files/20auto-upgrades b/rpi-base/files/20auto-upgrades
deleted file mode 100644
index 5d37e9f..0000000
--- a/rpi-base/files/20auto-upgrades
+++ /dev/null
@@ -1,4 +0,0 @@
-APT::Periodic::Update-Package-Lists "1";
-APT::Periodic::Download-Upgradeable-Packages "1";
-APT::Periodic::AutocleanInterval "7";
-APT::Periodic::Unattended-Upgrade "1";
diff --git a/rpi-base/files/52unattended-upgrades-local b/rpi-base/files/52unattended-upgrades-local
new file mode 100644
index 0000000..e567293
--- /dev/null
+++ b/rpi-base/files/52unattended-upgrades-local
@@ -0,0 +1,20 @@
+// Ansible managed (rpi-base). The whole auto-update config: the periodic
+// switches conventionally kept in the debconf-owned 20auto-upgrades, plus
+// local policy over the stock 50unattended-upgrades (left a pristine
+// distro conffile). This file sorts after both; apt gives later files the
+// last word on scalars and appends list entries, so 20auto-upgrades can
+// never disable these switches and Allowed-Origins keeps its security
+// entries while gaining -updates.
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Download-Upgradeable-Packages "1";
+APT::Periodic::AutocleanInterval "7";
+APT::Periodic::Unattended-Upgrade "1";
+
+// security (from 50) plus regular bugfix updates
+Unattended-Upgrade::Allowed-Origins {
+        "${distro_id}:${distro_codename}-updates";
+};
+
+// reboot at night when an installed update requires it
+Unattended-Upgrade::Automatic-Reboot "true";
+Unattended-Upgrade::Automatic-Reboot-Time "04:00";