[Unit]
# Policy and what was ruled out: wiki note prod-patching-policy, and
# setup-ca-certificates-refresh.sh beside this file.
Description=Refresh ca-certificates

[Service]
Type=oneshot
Environment=DEBIAN_FRONTEND=noninteractive
# Two commands, one package. Unattended-upgrades on this host does not read
# noble-updates (see the wiki note), and ca-certificates has historically
# reached noble-security only by Ubuntu's habit rather than by any guarantee.
# This closes that one gap without broadening what else may install itself
# unattended on the single production host.
ExecStart=/usr/bin/apt-get -q update
ExecStart=/usr/bin/apt-get -q -y --only-upgrade install ca-certificates

[Install]
WantedBy=multi-user.target