#!/bin/bash
# Install and configure unattended-upgrades for security patches. Deliberately
# conservative for a hypervisor: security-only origins (Debian security +
# the active PVE repo), no automatic reboot ever - a flag file is left at
# /var/run/reboot-required for you to act on manually.
#
# Idempotent - safe to re-run. Run as root on the PVE host.
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
# shellcheck source=lib/common.sh
source "${SCRIPT_DIR}/lib/common.sh"
require_root

if ! dpkg -s unattended-upgrades >/dev/null 2>&1; then
    apt-get update
    apt-get install -y unattended-upgrades
fi

CODENAME="$(pve_codename)"

write_if_changed "/etc/apt/apt.conf.d/51pve-unattended-upgrades.conf" "// Managed by proxmox-configuration/scripts/setup-unattended-upgrades.sh
Unattended-Upgrade::Origins-Pattern {
        \"origin=Debian,codename=${CODENAME},label=Debian-Security\";
        \"origin=Debian,codename=${CODENAME}-security,label=Debian-Security\";
        \"origin=Proxmox\";
};

// Never auto-reboot a hypervisor. Check /var/run/reboot-required manually
// (or via scripts/audit.sh) and reboot during a planned maintenance window.
Unattended-Upgrade::Automatic-Reboot \"false\";

// Don't remove packages automatically; review before doing so by hand.
Unattended-Upgrade::Remove-Unused-Dependencies \"false\";
Unattended-Upgrade::Remove-Unused-Kernel-Packages \"false\";"

write_if_changed "/etc/apt/apt.conf.d/20auto-upgrades" '// Managed by proxmox-configuration/scripts/setup-unattended-upgrades.sh
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
APT::Periodic::Download-Upgradeable-Packages "1";
APT::Periodic::AutocleanInterval "7";'

systemctl enable --now unattended-upgrades.service >/dev/null
echo "unattended-upgrades enabled (security-only origins, no auto-reboot)."
echo "Dry run:"
unattended-upgrade --dry-run --debug 2>&1 | tail -20