From a457c0932b697fd32febe79c473c7e06dccd355a Mon Sep 17 00:00:00 2001 From: Luke Hoersten Date: Sat, 1 Aug 2026 09:53:44 -0500 Subject: rpi-base: role-owned netplan replaces wpa_supplicant; auto-upgrades gain -updates and 04:00 reboot Networking: one 40-net.yaml (eth0 always, wifi via rpi_base_wifi_*) with cloud-init's 50-cloud-init.yaml deleted after first boot. cloud-init still renders it on an instance_id bump, and it sorts later, so editing the card's network-config and bumping meta-data is the headless rescue path. ssh_deletekeys off so a rescue bump keeps the host keys. Auto-updates: periodic switches and local policy merged into one 52unattended-upgrades-local; 50unattended-upgrades stays a distro conffile and debconf's 20auto-upgrades can no longer disable anything. --- rpi-base/files/10-rpi-base.cfg | 4 ++++ rpi-base/files/20auto-upgrades | 4 ---- rpi-base/files/52unattended-upgrades-local | 20 ++++++++++++++++++++ 3 files changed, 24 insertions(+), 4 deletions(-) create mode 100644 rpi-base/files/10-rpi-base.cfg delete mode 100644 rpi-base/files/20auto-upgrades create mode 100644 rpi-base/files/52unattended-upgrades-local (limited to 'rpi-base/files') diff --git a/rpi-base/files/10-rpi-base.cfg b/rpi-base/files/10-rpi-base.cfg new file mode 100644 index 0000000..7ce3927 --- /dev/null +++ b/rpi-base/files/10-rpi-base.cfg @@ -0,0 +1,4 @@ +# Ansible managed (rpi-base). A rescue instance_id bump re-runs the +# cloud-init ssh module, which by default deletes and regenerates the +# ssh host keys on a new instance; keep them. +ssh_deletekeys: false diff --git a/rpi-base/files/20auto-upgrades b/rpi-base/files/20auto-upgrades deleted file mode 100644 index 5d37e9f..0000000 --- a/rpi-base/files/20auto-upgrades +++ /dev/null @@ -1,4 +0,0 @@ -APT::Periodic::Update-Package-Lists "1"; -APT::Periodic::Download-Upgradeable-Packages "1"; -APT::Periodic::AutocleanInterval "7"; -APT::Periodic::Unattended-Upgrade "1"; diff --git a/rpi-base/files/52unattended-upgrades-local b/rpi-base/files/52unattended-upgrades-local new file mode 100644 index 0000000..e567293 --- /dev/null +++ b/rpi-base/files/52unattended-upgrades-local @@ -0,0 +1,20 @@ +// Ansible managed (rpi-base). The whole auto-update config: the periodic +// switches conventionally kept in the debconf-owned 20auto-upgrades, plus +// local policy over the stock 50unattended-upgrades (left a pristine +// distro conffile). This file sorts after both; apt gives later files the +// last word on scalars and appends list entries, so 20auto-upgrades can +// never disable these switches and Allowed-Origins keeps its security +// entries while gaining -updates. +APT::Periodic::Update-Package-Lists "1"; +APT::Periodic::Download-Upgradeable-Packages "1"; +APT::Periodic::AutocleanInterval "7"; +APT::Periodic::Unattended-Upgrade "1"; + +// security (from 50) plus regular bugfix updates +Unattended-Upgrade::Allowed-Origins { + "${distro_id}:${distro_codename}-updates"; +}; + +// reboot at night when an installed update requires it +Unattended-Upgrade::Automatic-Reboot "true"; +Unattended-Upgrade::Automatic-Reboot-Time "04:00"; -- cgit v1.2.3