Unattended Updates That Are Actually Applied

dnf-automatic

Unattended updates on Enterprise Linux that are applied, not merely downloaded. Original role for EL 9 and 10, live-tested with podman on Rocky Linux 10.

The package installs nothing. dnf-automatic ships with download_updates = yes and apply_updates = no, and installs four systemd timers with none of them enabled. A host that "has dnf-automatic" therefore has a daily download of updates it never installs, and only if somebody enabled a timer. This role sets apply_updates = yes, restricts the run to security advisories, enables exactly one timer (dnf-automatic.timer, the one that reads the configuration) and switches off the three single-purpose timers so nothing runs twice.

Reboots are a decision. A kernel or glibc update is installed but does nothing until the machine restarts. dnf_automatic_reboot takes never (the default here), when-changed or when-needed; the reboot command and its five-minute warning are yours to set. The role leaves the choice to you because an unplanned restart of a database is worse than a stale kernel for a night - but leave it at never and somebody has to be the one who notices.

Fleets stagger. dnf_automatic_random_sleep spreads runs over five minutes by default so a hundred hosts do not hit the mirror at 06:00:00.

License

Commercial - IaC Bazaar EULA. (c) IaC Bazaar.