#7553 unattached-upgrade changes for server

CHANGELOG.md

@@ -7,6 +7,7 @@
 - Protect individual certificate endpoint with token
 - Kibana disk space alerts now work regardless of your disk device names. Alerts listen devices mounted both to `/` and `/data` (encrypted data partition)
 - "Publish release" pipeline now correctly uses the "Branch to build from" value as the branch to be tagged. Previously it tried tagging "master". "Release tag" is also now used as the release version as is instead of it being read from `package.json`.
+- Enabled auto upgrade of kernel and application dependencies through unattached-upgrade service along with automatic cleanup of downloaded packages every weekly on Ubuntu servers.
 
 ### Breaking changes
 

infrastructure/server-setup/tasks/updates.yml

@@ -21,8 +21,31 @@
       Unattended-Upgrade::Remove-New-Unused-Dependencies "true";
       Unattended-Upgrade::Remove-Unused-Dependencies "true";
       Unattended-Upgrade::Allowed-Origins {
+          "${distro_id}:${distro_codename}";
           "${distro_id}:${distro_codename}-security";
+          "${distro_id}ESMApps:${distro_codename}-apps-security";
+          "${distro_id}ESM:${distro_codename}-infra-security";
+          "${distro_id}:${distro_codename}-updates";
       };
+
     owner: root
     group: root
     mode: '0644'
+
+- name: Autoclean Unattended Upgrades    
+  ansible.builtin.copy:
+    dest: /etc/apt/apt.conf.d/20auto-upgrades
+    content: |
+      APT::Periodic::Update-Package-Lists "1";
+      APT::Periodic::Unattended-Upgrade "1";
+      APT::Periodic::AutocleanInterval "7";
+
+    owner: root
+    group: root
+    mode: '0644'
+
+- name: Restart Unattended-upgrades service
+  ansible.builtin.service:
+    name: unattended-upgrades
+    state: restarted
+