# Common Role

Base setup applied first by `site.yml` (tag `common`).

## What it does
- Installs `aptitude` and `jq`.
- Installs `unattended-upgrades` and turns on daily security updates
  (Debian security archive only, no automatic reboots).
- Makes sure UFW is enabled with default deny. The SSH rule comes from the
  bootstrap role, and container rules from `ufw-docker` in the docker role.

## Usage
```bash
bin/deploy --tags common
```