debian: enable automatic upgrades only for virtual machines

And factor out VM stuff into a separate file.

roles/debian/tasks/main.yml

@@ -89,19 +89,6 @@
   include_tasks: firewall.yml
   when: not is_proxmox # proxmox has its own firewall configuration
 
-- name: Install automatic upgrade package
-  package:
-    name: unattended-upgrades
-
-- name: Configure automatic upgrades
-  lineinfile:
-    path: /etc/apt/apt.conf.d/20auto-upgrades
-    create: yes
-    line: '{{ item }}'
-  loop:
-    - 'APT::Periodic::Update-Package-Lists "1";'
-    - 'APT::Periodic::Unattended-Upgrade "1";'
-
 - name: Run SSH instance in management VRF
   when: interfaces | selectattr('vrf') | selectattr('vrf.name', '==', 'mgmt')
   block:
@@ -124,3 +111,6 @@
         name: sshd@mgmt
         enabled: yes
       notify: reboot
+
+- when: is_virtual
+  include_tasks: vm.yml

roles/debian/tasks/vm.yml

@@ -0,0 +1,12 @@
+- name: Install automatic upgrade package
+  package:
+    name: unattended-upgrades
+
+- name: Configure automatic upgrades
+  lineinfile:
+    path: /etc/apt/apt.conf.d/20auto-upgrades
+    create: yes
+    line: '{{ item }}'
+  loop:
+    - 'APT::Periodic::Update-Package-Lists "1";'
+    - 'APT::Periodic::Unattended-Upgrade "1";'