infra-status/ansible/upgrade.yml

- name: Update and upgrade apt packages
  gather_facts: false
  hosts: all
  serial: 1
  tasks:
    - name: Upgrade packages
      apt:
        upgrade: true
        update_cache: true
        cache_valid_time: 86400
    - name: Remove unused packages
      apt:
        autoremove: true
      register: packages
    - reboot:
      when: packages.changed