Create unattended-upgrades profile

profile/manifests/apt.pp

 # APT profile
 class profile::apt (
   Boolean $auto_reboot                = true,
-  Optional[Boolean] $legacy_origin    = $unattended_upgrades::params::legacy_origin,
-  Optional[Array[String[1]]] $origins = $unattended_upgrades::params::origins,
 ) {
 
   include apt
@@ -13,21 +11,8 @@ class profile::apt (
     content  => "Apt::Install-Recommends 0;\nApt::AutoRemove::InstallRecommends 1;\n",
   })
 
-  # workaround for Docker, which can't infer the following from `lsbdistid`
-  # fact.
-  $real_legacy_origin = $legacy_origin ? { undef => false, default => $legacy_origin }
-  $real_origins = $origins ? {
-    undef => [
-      'origin=Debian,codename=buster,label=Debian',
-      'origin=Debian,codename=buster,label=Debian-Security',
-    ],
-    default => $origins
-  }
-
-  class { 'unattended_upgrades':
-    auto          => { 'reboot' => $auto_reboot },
-    legacy_origin => $real_legacy_origin,
-    origins       => $real_origins,
+  class { 'profile::apt::unattended_upgrades':
+    auto_reboot => $auto_reboot,
   }
 
 }

profile/manifests/apt/unattended_upgrades.pp

+# APT unattended_upgrades profile
+class profile::apt::unattended_upgrades (
+  Boolean $auto_reboot = true,
+) inherits unattended_upgrades::params {
+
+  # workaround for Docker, which can't infer the following from `lsbdistid`
+  # fact.
+  $real_legacy_origin = $legacy_origin ? { undef => false, default => $legacy_origin }
+  $real_origins = $origins ? {
+    undef => [
+      'origin=Debian,codename=buster,label=Debian',
+      'origin=Debian,codename=buster,label=Debian-Security',
+    ],
+    default => $origins
+  }
+
+  class { 'unattended_upgrades':
+    auto          => { 'reboot' => $auto_reboot },
+    legacy_origin => $real_legacy_origin,
+    origins       => $real_origins,
+  }
+
+}