class Kitsune::Kit::Commands::SetupUnattended

def perform_setup(ssh)
  output = ssh.exec! <<~EOH
    set -e
    sudo mkdir -p /usr/local/backups
    sudo chown deploy:deploy /usr/local/backups
    RESOURCE="/etc/apt/apt.conf.d/20auto-upgrades"
    BACKUP_DIR="/usr/local/backups"
    SCRIPT_ID="setup_unattended"
    BACKUP_FILE="${BACKUP_DIR}/${SCRIPT_ID}.before"
    MARKER_FILE="${BACKUP_DIR}/${SCRIPT_ID}.after"
    echo "✍🏻 Installing required packages…"
    if ! dpkg -l | grep -q "^ii\\s*unattended-upgrades"; then
      sudo apt-get update -y
      sudo apt-get install -y unattended-upgrades apt-listchanges && echo "   - packages installed"
    else
      echo "   - unattended-upgrades already installed"
    fi
    if [ ! -f "$MARKER_FILE" ]; then
      echo "✍🏻 Backing up existing config…"
      sudo cp "$RESOURCE" "$BACKUP_FILE" && echo "   - backup saved to $BACKUP_FILE"
      sudo touch "$MARKER_FILE" && echo "   - marker created at $MARKER_FILE"
    else
      echo "   - backup & marker already exist"
    fi
    echo "✍🏻 Applying new auto-upgrades config…"
    sudo tee "$RESOURCE" > /dev/null <<UPGR
dic::Update-Package-Lists "1";
dic::Download-Upgradeable-Packages "1";
dic::AutocleanInterval "7";
dic::Unattended-Upgrade "1";
    echo "   - config applied"
    echo "✍🏻 Enabling & restarting unattended-upgrades…"
    sudo systemctl --quiet enable unattended-upgrades.service >/dev/null 2>&1 && echo "   - service enabled"
    sudo systemctl --quiet restart unattended-upgrades.service && echo "   - service restarted"
  EOH
  say output
  say "✅ Unattended-upgrades setup completed", :green
end