bootstrap: linting, handle oomd

roles/bootstrap/tasks/dnf.yml

@@ -1,29 +1,38 @@
 ---
-- name: raise max_parallel_downloads to 20
-  lineinfile:
+- name: Raise max_parallel_downloads to 20
+  become: true
+  ansible.builtin.lineinfile:
     path: /etc/dnf/dnf.conf
     regexp: "^max_parallel_downloads.="
     line: "max_parallel_downloads=20"
 
-- name: install dnf-automatic
-  package:
-    name: dnf-automatic
-    state: present
+- name: Prepare automatic upgrade w/ dnf-automatic
+  block:
+    - name: Install dnf-automatic
+      become: true
+      ansible.builtin.package:
+        name: dnf-automatic
+        state: present
 
-- name: configure dnf-automatic
-  become: true
-  lineinfile:
-    path: /etc/dnf/automatic.conf
-    state: present
-    regexp: "{{ item.regexp }}"
-    line: "{{ item.line }}"
-  with_items:
-    - { regexp: '^upgrade_type.=', line: 'upgrade_type = security' }
-    - { regexp: '^emit_via.=', line: 'emit_via = stdio,motd' }
-    - { regexp: '^apply_updates.=', line: 'apply_updates = yes' }
+    - name: Configure dnf-automatic
+      become: true
+      ansible.builtin.lineinfile:
+        path: /etc/dnf/automatic.conf
+        state: present
+        regexp: "{{ item.regexp }}"
+        line: "{{ item.line }}"
+      with_items:
+        - {regexp: '^upgrade_type.=', line: 'upgrade_type = default'}
+        - {regexp: '^emit_via.=', line: 'emit_via = stdio,motd'}
+        - {regexp: '^apply_updates.=', line: 'apply_updates = no'}
+        - {regexp: '^download_updates.=', line: 'download_updates = yes'}
 
-- name: enable dnf-automatic timer
-  systemd:
-    name: dnf-automatic.timer
-    state: started
-    enabled: yes
+    - name: Enable dnf-automatic timer
+      become: true
+      ansible.builtin.systemd:
+        name: dnf-automatic.timer
+        state: started
+        enabled: true
+  when:
+    - auto_update is defined
+    - auto_update | bool