diff --git a/defaults/main.yaml b/defaults/main.yaml
new file mode 100644
index 0000000..70a3e63
--- /dev/null
+++ b/defaults/main.yaml
@@ -0,0 +1,2 @@
+---
+unattended_upgrades: true
diff --git a/tasks/main.yaml b/tasks/main.yaml
new file mode 100644
index 0000000..ff77488
--- /dev/null
+++ b/tasks/main.yaml
@@ -0,0 +1,17 @@
+---
+
+- name: update apt cache
+  apt:
+    update_cache: true
+    cache_valid_time: 3600
+
+- name: upgrade all packages
+  apt:
+    upgrade: dist
+
+- name: unattended-upgrades
+  apt:
+    name: unattended-upgrades
+  when:
+    - unattended_upgrades
+    - not ansible_bender is defined