Close Karakeep signups and turn on unattended security updates

Karakeep had DISABLE_SIGNUPS unset, so anyone could make an account on
bookmarks. and use the OpenAI key behind it. The server also had no
automatic updates and three security updates waiting; the common role now
installs unattended-upgrades with Debian's default security-only origins.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/common/README.md

@@ -4,6 +4,8 @@ Base setup applied first by `site.yml` (tag `common`).
 
 ## What it does
 - Installs `aptitude` and `jq`.
+- Installs `unattended-upgrades` and turns on daily security updates
+  (Debian security archive only, no automatic reboots).
 - Makes sure UFW is enabled with default deny. The SSH rule comes from the
   bootstrap role, and container rules from `ufw-docker` in the docker role.
 

roles/common/tasks/main.yml

@@ -9,4 +9,19 @@
 - name: UFW - Enable and deny by default
   community.general.ufw:
     state: enabled
-    default: deny
+    default: deny
+# Security updates install themselves each day (Debian's default origins:
+# the -security archive only). No automatic reboots.
+- name: Install unattended-upgrades
+  ansible.builtin.apt:
+    name: unattended-upgrades
+    state: present
+
+- name: Turn on daily unattended upgrades
+  ansible.builtin.copy:
+    dest: /etc/apt/apt.conf.d/20auto-upgrades
+    owner: root
+    mode: '0644'
+    content: |
+      APT::Periodic::Update-Package-Lists "1";
+      APT::Periodic::Unattended-Upgrade "1";

roles/docker/templates/hoarder-env.j2

@@ -7,4 +7,6 @@ OAUTH_CLIENT_SECRET={{ vault_hoarder.pocketid.client_secret }}
 OAUTH_CLIENT_ID={{ vault_hoarder.pocketid.client_id }}
 OAUTH_PROVIDER_NAME=Pocket ID
 OAUTH_WELLKNOWN_URL=https://{{ subdomains.pocketid }}/.well-known/openid-configuration
-OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=false
+OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING=false
+# Karakeep allows open signups unless this is set. Unset it briefly to add a user.
+DISABLE_SIGNUPS=true