- name: install and configure automatic security updates
  hosts: wireguard
  become: true

  tasks:
    - name: install dnf-automatic
      dnf:
        name:
          - dnf-automatic
        state: present

    - name: edit update type to security only
      ansible.builtin.ini_file:
        path: /etc/dnf/automatic.conf
        section: commands
        option: upgrade_type
        value: security

    - name: allow automatic installation of updates
      ansible.builtin.ini_file:
        path: /etc/dnf/automatic.conf
        section: commands
        option: apply_updates
        value: "yes"

    - name: start and enable dnf-automatic install timer
      ansible.builtin.systemd:
        name: dnf-automatic-install.timer
        enabled: true
        state: started