sudo apt install unattended-upgrades apt-listchanges -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

# Test configuration
sudo unattended-upgrade --dry-run --debug

# Run immediately
sudo unattended-upgrade -v

# Dry run first — see what would change
ansible-playbook playbooks/patch.yml \
  --check --diff \
  -e "target_hosts=webservers" \
  -e "enforce_maintenance_window=false"

# Patch staging (no maintenance window enforcement)
ansible-playbook playbooks/patch.yml \
  -e "target_hosts=staging" \
  -e "enforce_maintenance_window=false" \
  -e "allow_reboot=true" \
  -e "batch_size=50%"

# Patch production during maintenance window
ansible-playbook playbooks/patch.yml \
  -e "target_hosts=production" \
  -e "allow_reboot=true" \
  -e "batch_size=1" \  # One host at a time
  -e "slack_webhook=https://hooks.slack.com/..."

# Patch specific host
ansible-playbook playbooks/patch.yml \
  --limit "web-01.example.com" \
  -e "enforce_maintenance_window=false"

# /etc/cron.d/ansible-patching
# Patch all servers Saturday at 3am UTC
0 3 * * 6 deploy /usr/local/bin/ansible-patching.sh >> /var/log/ansible-patching.log 2>&1

#!/bin/bash
# /usr/local/bin/ansible-patching.sh

set -e

ANSIBLE_DIR="/opt/ansible"
LOG_FILE="/var/log/ansible-patching.log"
SLACK_WEBHOOK="${SLACK_WEBHOOK_PATCHING}"

log() {
  echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}

log "Starting scheduled patching run"

cd "$ANSIBLE_DIR"

# Update Ansible itself first
pip install -q --upgrade ansible

# Run patching
if ansible-playbook playbooks/patch.yml \
  -e "allow_reboot=true" \
  -e "slack_webhook=${SLACK_WEBHOOK}" \
  >> "$LOG_FILE" 2>&1; then
  log "Patching completed successfully"
else
  log "Patching FAILED"
  curl -s -X POST "$SLACK_WEBHOOK" \
    -H "Content-type: application/json" \
    -d '{"text": ":x: Scheduled patching FAILED — check /var/log/ansible-patching.log"}'
  exit 1
fi

# Generate report: which hosts need patches
cat > playbooks/patch-report.yml << 'EOF'
---
- name: Patch compliance report
  hosts: all
  become: true
  gather_facts: true
  tasks:
    - name: Check upgradeable packages
      command: apt list --upgradeable 2>/dev/null
      register: upgradeable
      changed_when: false
      when: ansible_os_family == "Debian"

    - name: Check security updates available
      command: apt-get -s upgrade 2>&1 | grep "upgraded"
      register: security_check
      changed_when: false
      when: ansible_os_family == "Debian"

    - name: Write host report
      delegate_to: localhost
      lineinfile:
        path: /tmp/patch-report.csv
        line: "{{ inventory_hostname }},{{ ansible_distribution }},{{ ansible_distribution_version }},{{ upgradeable.stdout_lines | length }}"
        create: true
EOF

ansible-playbook playbooks/patch-report.yml
cat /tmp/patch-report.csv | column -t -s,

# Enable Canonical Livepatch
sudo snap install canonical-livepatch
sudo canonical-livepatch enable <your-token>

# Check live patch status
sudo canonical-livepatch status --verbose

# Install kpatch
sudo dnf install kpatch

# List available patches
sudo kpatch list

# Load a patch (no reboot required)
sudo kpatch load /usr/lib/kpatch/$(uname -r)/kpatch-*.ko

# Make persistent across reboots
sudo kpatch install /usr/lib/kpatch/$(uname -r)/kpatch-*.ko

# Push patch metrics to Prometheus pushgateway
push_metric() {
  local HOST=$1
  local PACKAGES_UPDATED=$2
  local REBOOT_REQUIRED=$3

  cat <<EOF | curl -s --data-binary @- \
    "http://pushgateway.example.com:9091/metrics/job/ansible_patching/instance/${HOST}"
ansible_last_patch_timestamp $(date +%s)
ansible_packages_updated_total ${PACKAGES_UPDATED}
ansible_reboot_required ${REBOOT_REQUIRED}
EOF
}

# Call from your patching script after completion
push_metric "web-01" "23" "0"

#!/bin/bash
# patch-pipeline.sh — run staging first, then prod after validation

set -e

echo "=== Patching staging ==="
ansible-playbook playbooks/patch.yml \
  -e "target_hosts=staging" \
  -e "enforce_maintenance_window=false" \
  -e "allow_reboot=true"

echo "=== Running smoke tests against staging ==="
./scripts/smoke-test.sh staging.example.com
SMOKE_RESULT=$?

if [ $SMOKE_RESULT -ne 0 ]; then
  echo "Staging smoke tests FAILED — aborting production patching"
  curl -s -X POST "$SLACK_WEBHOOK" \
    -H "Content-type: application/json" \
    -d '{"text":":x: Patch pipeline aborted — staging smoke tests failed. Production patching skipped."}'
  exit 1
fi

echo "=== Staging clean — patching production ==="
ansible-playbook playbooks/patch.yml \
  -e "target_hosts=production" \
  -e "allow_reboot=true" \
  -e "batch_size=1"