APT Ansible Role (ansible-role-apt) from Blunix GmbH

This Ansible role configures APT on Debian servers, installs a curated base package set, and tunes unattended upgrades plus systemd timers for regular updates—exactly as we use it in production.

The Ansible Role is written and actively maintained by Blunix GmbH. It is used in the Blunix Linux Managed Hosting Stack. Its usage is documented at our Linux Managed Hosting Documentation.

Features

• Installs a configurable base set of useful packages for Debian servers (editors, networking tools, Python tooling, etc.).
• Enables unattended upgrades via debconf and splits updates into dedicated systemd timers for security updates (15-minute cadence) and versions (SLA Wartungsfenster).
• Disables the default apt-daily-upgrade timer, keeps apt-daily hourly for fresh indexes, and ships dedicated services/timers for security upgrades, version upgrades, and kernel reboots.
• Tunes haveged when installed via this role.
• Runs apt-get autoremove to clean up unused packages.

Requirements

• Ansible: >= 2.20.0
• Managed operating systems:
  • Debian trixie

Role variables, inventory and example playbook

Production playbooks apply the role without overrides; if you want to customize base packages, use the inventory example below. The full example lives under example/:

• example/inventory/group_vars/all/apt.yml — optional apt_default_packages override plus SLA-driven timers for security/version updates and kernel reboots.
• example/play.yml — minimal play applying the role to all hosts.

The defaults cover the base package set, unattended upgrades via debconf, SLA-aligned timers for security and version updates, and a dedicated kernel reboot timer.

Managed files and templates

• /etc/apt/apt.conf.d/50unattended-upgrades — base config for unattended-upgrades (Automatic-Reboot handled separately); kept because unattended-upgrade always reads this file even when invoked via custom timers.
• /etc/systemd/system/apt-daily.timer.d/override.conf (runs hourly).
• /etc/systemd/system/apt-security-upgrade.service and .timer (15-minute cadence, security updates only).
• /etc/systemd/system/apt-version-upgrade.service and .timer (SLA Wartungsfenster cadence, version updates).
• /etc/systemd/system/apt-kernel-reboot.service and .timer (reboots when /var/run/reboot-required exists, Wartungsfenster).
• /etc/default/haveged (only when haveged is in apt_default_packages).

Infrastructure As Code Tests

• Provision: use dev-tools/main.tf with the apt role enabled to create a test host.
• Playbook: example/play.yml applies the role, seeds the timer overrides, and configures unattended-upgrades.
• Tests in example/tests/:
  • cus-dev-prod-web-1/test_systemd_timers.py: verifies apt-daily plus the custom security/version/reboot timers are installed and enabled while apt-daily-upgrade is disabled.
  • cus-dev-prod-web-1/test_timer_overrides.py: validates timer schedules for the security, version, and reboot timers.

Author Information

Blunix GmbH Berlin

root@Linux:~# Support | Consulting | Hosting | Training

Blunix GmbH provides 24/7/365 Linux emergency support and consulting, Service Level Agreements for Debian Linux managed hosting using Ansible Configuration Management as well as Linux trainings and workshops.

Learn more at https://www.blunix.com.

Contact Information

Click here to see our Contact Information.

For bug reports and feature requests, please open an issue in this repository’s GitHub issue tracker.

License

Apache-2.0

Please refer to the LICENSE file in the root of this repository.