@shuro yeah, the unattended-upgrades package is installed. But you will have to enable auto-reboot manually.
If someone is too lazy, here's a simple ansible playbook that does everything.
---
- name: Set up unattended security updates
hosts: work_hosts
become: true # Use sudo to run the tasks
tasks:
- name: Update apt cache
ansible.builtin.apt:
update_cache: yes
- name: Install unattended-upgrades if not installed already
ansible.builtin.package:
name:
- unattended-upgrades
state: present
- name: Ensure autoreboot is enabled
#Do it only if you can. It may break something in a reboot. Enjoy fixing it yourself
ansible.builtin.lineinfile:
dest: /etc/apt/apt.conf.d/50unattended-upgrades
regexp: Unattended-Upgrade::Automatic-Reboot-Time "02:00";
#you like rebooting all servers at the same time, don't you?
line: Unattended-Upgrade::Automatic-Reboot-Time "02:00";