Close Karakeep signups and turn on unattended security updates

Karakeep had DISABLE_SIGNUPS unset, so anyone could make an account on
bookmarks. and use the OpenAI key behind it. The server also had no
automatic updates and three security updates waiting; the common role now
installs unattended-upgrades with Debian's default security-only origins.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

roles/common/README.md

@@ -4,6 +4,8 @@ Base setup applied first by `site.yml` (tag `common`).
 
 ## What it does
 - Installs `aptitude` and `jq`.
+- Installs `unattended-upgrades` and turns on daily security updates
+  (Debian security archive only, no automatic reboots).
 - Makes sure UFW is enabled with default deny. The SSH rule comes from the
   bootstrap role, and container rules from `ufw-docker` in the docker role.
 

roles/common/tasks/main.yml

@@ -9,4 +9,19 @@
 - name: UFW - Enable and deny by default
   community.general.ufw:
     state: enabled
-    default: deny
+    default: deny
+# Security updates install themselves each day (Debian's default origins:
+# the -security archive only). No automatic reboots.
+- name: Install unattended-upgrades
+  ansible.builtin.apt:
+    name: unattended-upgrades
+    state: present
+
+- name: Turn on daily unattended upgrades
+  ansible.builtin.copy:
+    dest: /etc/apt/apt.conf.d/20auto-upgrades
+    owner: root
+    mode: '0644'
+    content: |
+      APT::Periodic::Update-Package-Lists "1";
+      APT::Periodic::Unattended-Upgrade "1";