diff --git a/files/cron-apt/cron-apt.service b/files/cron-apt/cron-apt.service
new file mode 100644
index 0000000..9c52b76
--- /dev/null
+++ b/files/cron-apt/cron-apt.service
@@ -0,0 +1,6 @@
+[Unit]
+Description=Runs periodical apt upgrades
+
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/cron-apt
diff --git a/files/cron-apt/cron-apt.timer b/files/cron-apt/cron-apt.timer
new file mode 100644
index 0000000..f6ed62c
--- /dev/null
+++ b/files/cron-apt/cron-apt.timer
@@ -0,0 +1,8 @@
+[Unit]
+Description=Runs daily apt upgrades
+
+[Install]
+WantedBy=timers.target
+
+[Timer]
+OnCalendar=4:00
diff --git a/tasks/os-debian.yml b/tasks/os-debian.yml
index b794330..115c64a 100644
--- a/tasks/os-debian.yml
+++ b/tasks/os-debian.yml
@@ -7,10 +7,12 @@
   copy:
     dest: /etc/apt/apt.conf.d/99AutomaticClean
     content: |
-      Aptitude::Clean-After-Install "{{if true == apt_clean_after_install || apt_proxy is defined then 'true' else 'false'}}";
+      Aptitude::Clean-After-Install "{{value}}";
     owner: root
     group: root
     mode: 0644
+  vars:
+    value: "{{if true == apt_clean_after_install or apt_proxy is defined  then  'true'  else  'false'}}"
 - name: "Use proxy for apt http"
   when: "apt_proxy is defined"
   copy:
@@ -153,9 +155,17 @@
     mode:   0644
   with_dict:
     cron-apt/action.d/6-upgrade: /etc/cron-apt/action.d/6-upgrade
+    cron-apt/cron-apt.service: /etc/systemd/system/cron-apt.service
+    cron-apt/cron-apt.timer: /etc/systemd/system/cron-apt.timer
   notify:
   - restart services
 
+- name: no cron-apt crontabs
+  lineinfile:
+    path: /etc/cron.d/cron-apt
+    line: '# 0 4 * * * root  test -x /usr/sbin/cron-apt && /usr/sbin/cron-apt'
+    regexp: '^\s*[^#].*/usr/sbin/cron-apt'
+
 - name: copy configs
   template:
     src:    "{{item.key}}"
@@ -228,8 +238,11 @@
     src: '../../bin/k{{item}}'
   with_items: [dig, nsupdate]
 
-- name: enable ssh
+- name: enable service
   systemd: 
-    name: ssh
+    name: '{{item}}'
     enabled: yes
     state: started
+  with_items:
+  - ssh.service
+  - cron-apt.timer