Use unattended-upgrades again to make sure packages are up-to-date.

We don't have the time to test all upgrades in advance.  Therefore, it's
safer to install all updates unattended and live with the (rare) risk of
faulty ones.

This reverts the commits:
  b4d9cbdb94
  a29d89a7ab

lmn-client.yml

@@ -37,6 +37,12 @@
           /srv/samba/schools/default-school/students/*/
           /srv/samba/schools/default-school/examusers/
         vtype: string
+    - name: Preseed unattended-upgrades
+      debconf:
+        name: unattended-upgrades
+        question: unattended-upgrades/enable_auto_updates
+        value: true
+        vtype: boolean
 
   vars_files: lmn-vault
   vars:
@@ -70,6 +76,7 @@
       - mc
       - tmux
       - krb5-user
+      - unattended-upgrades
       - debconf-utils
     extra_pkgs_bpo: [] # [ linux-image-amd64 ]
 
@@ -197,7 +204,6 @@
     - name: Remove packages we do not need anymore
       ansible.builtin.apt:
         name:
-          - unattended-upgrades
           - cachefilesd
           - mosquitto
         state: absent

roles/lmn_fvs/tasks/main.yml

@@ -132,6 +132,12 @@
         "ProxyMode": "auto_detect"
       }
 
+- name: Update all packages unattended
+  ansible.builtin.replace:
+    path: /etc/apt/apt.conf.d/50unattended-upgrades
+    regexp: '^//(\s+"origin=.+-updates";)$'
+    replace: '  \1'
+
 - name: Copy some scripts
   copy:
     src: "{{ item }}"