run chef-client and unattended upgrades as services; add ack