---
- name: Update apt cache
  ansible.builtin.apt:
    update_cache: true
    cache_valid_time: 3600

- name: Install base packages
  ansible.builtin.apt:
    name:
      - ca-certificates
      - curl
      - gnupg
      - nftables
      - acl
      - rsync
      - python3
      - unattended-upgrades
    state: present

- name: Get current timezone
  ansible.builtin.command: timedatectl show -p Timezone --value
  register: current_tz
  changed_when: false

- name: Set system timezone
  ansible.builtin.command: "timedatectl set-timezone {{ host_timezone }}"
  when:
    - host_timezone | length > 0
    - current_tz.stdout != host_timezone

- name: Enable unattended security upgrades
  ansible.builtin.copy:
    dest: /etc/apt/apt.conf.d/20auto-upgrades
    owner: root
    group: root
    mode: "0644"
    content: |
      APT::Periodic::Update-Package-Lists "1";
      APT::Periodic::Unattended-Upgrade "1";