rpi-base: role-owned netplan replaces wpa_supplicant; auto-upgrades gain -updates and 04:00 reboot

Networking: one 40-net.yaml (eth0 always, wifi via rpi_base_wifi_*) with
cloud-init's 50-cloud-init.yaml deleted after first boot. cloud-init still
renders it on an instance_id bump, and it sorts later, so editing the
card's network-config and bumping meta-data is the headless rescue path.
ssh_deletekeys off so a rescue bump keeps the host keys.

Auto-updates: periodic switches and local policy merged into one
52unattended-upgrades-local; 50unattended-upgrades stays a distro
conffile and debconf's 20auto-upgrades can no longer disable anything.

2 files changed, 18 insertions, 14 deletions

diff --git a/rpi-base/templates/40-net.yaml.j2 b/rpi-base/templates/40-net.yaml.j2
new file mode 100644
index 0000000..f473a2b
--- /dev/null
+++ b/rpi-base/templates/40-net.yaml.j2
@@ -0,0 +1,18 @@
+# {{ansible_managed}}
+
+network:
+  version: 2
+  ethernets:
+    eth0:
+      dhcp4: true
+      optional: true
+{% if rpi_base_enable_wifi %}
+  wifis:
+    wlan0:
+      regulatory-domain: "US"
+      dhcp4: true
+      optional: true
+      access-points:
+        "{{rpi_base_wifi_ssid}}":
+          password: "{{rpi_base_wifi_password}}"
+{% endif %}
diff --git a/rpi-base/templates/wpa_supplicant.conf.j2 b/rpi-base/templates/wpa_supplicant.conf.j2
deleted file mode 100644
index c1312d0..0000000
--- a/rpi-base/templates/wpa_supplicant.conf.j2
+++ /dev/null
@@ -1,14 +0,0 @@
-# {{ansible_managed}}
-
-country=US
-ctrl_interface=DIR=/var/run/wpa_supplicant GROUP=netdev
-update_config=1
-{% for network in wpa_networks %}
-
-network={
-    ssid="{{network.ssid}}"
-    psk="{{network.psk}}"
-    disabled={% if rpi_base_enable_wifi %}0{% else %}1{% endif %}
-
-}
-{% endfor %}