From 7580daa40002cd9f844edd8765fba9ba57d160ea Mon Sep 17 00:00:00 2001
From: Seth Etter <mail@sethetter.com>
Date: Fri, 11 Sep 2026 12:21:03 -0500
Subject: [PATCH] debian: enable unattended security upgrades

---
 debian/README.md         |  1 +
 debian/ansible/setup.yml | 16 ++++++++++++++++
 2 files changed, 17 insertions(+)

diff --git a/debian/README.md b/debian/README.md
index 2ebf105..4b186ad 100644
--- a/debian/README.md
+++ b/debian/README.md
@@ -36,6 +36,7 @@ ansible-playbook ~/dotfiles/debian/ansible/update.yml --ask-become-pass
 - Helium extensions (1Password, Vimium, Margin) via Chromium force-install policy
 - clones dotfiles to `~/dotfiles` and runs `sync.sh`
 - login shell → zsh; default browser → Helium
+- unattended security upgrades (daily, Debian's stock config)
 
 ## Caveats
 
diff --git a/debian/ansible/setup.yml b/debian/ansible/setup.yml
index 6a3fb8b..21a0f3a 100644
--- a/debian/ansible/setup.yml
+++ b/debian/ansible/setup.yml
@@ -94,6 +94,22 @@
         update_cache: true
       become: true
 
+    - name: Enable unattended security upgrades
+      ansible.builtin.apt:
+        name: unattended-upgrades
+        state: present
+      become: true
+
+    # The package's postinst writes this file from debconf answers; set it
+    # explicitly so the enabled state does not depend on debconf defaults.
+    - name: Run unattended upgrades daily
+      ansible.builtin.copy:
+        dest: /etc/apt/apt.conf.d/20auto-upgrades
+        mode: "0644"
+        content: |
+          APT::Periodic::Update-Package-Lists "1";
+          APT::Periodic::Unattended-Upgrade "1";
+
     - name: Look up latest ghostty and obsidian releases
       ansible.builtin.uri:
         url: "https://api.github.com/repos/{{ item.repo }}/releases?per_page=10"
-- 
2.51.2