// Unattended upgrades, restricted to the OnyxPlay origin.
//
// This is the whole update mechanism for the fleet (registry §7.17/v2.155): the
// CP has no update surface, so a node converges by pulling a newer packager-node
// from the suite it is subscribed to. Rollout control lives in the repo
// (publish canary → soak → promote stable), not here.
//
// Origins-Pattern is deliberately narrow — this must never turn into a general
// auto-upgrade of the whole OS. Kernel and driver updates stay manual, behind an
// operator drain (an empty desired set stops the node's workers gracefully).
Unattended-Upgrade::Origins-Pattern {
    "origin=OnyxPlay";
};

// Never auto-reboot: a reboot drops every live channel this node serves. The
// packager-node upgrade itself does not need one. Nor does it restart the
// agent: the postinst only prints a hint, and the operator restarts
// packager-node-agent at their own pace (workers are re-adopted, not restarted).
Unattended-Upgrade::Automatic-Reboot "false";

// The periodic keys that actually arm unattended-upgrades. Without these the
// config above is inert and nodes silently never update.
APT::Periodic::Update-Package-Lists "1";
APT::Periodic::Unattended-Upgrade "1";
