properly configure APT unattended-upgrades