Linux

Fully Automatic Updates in Debian

Joshua Martin

— 1 min read
Fully Automatic Updates in Debian
Photo by JJ Jordan / Unsplash

I was searching for an image of a progress bar and found this. So there's that.

Irrelevant cover photos aside, It is in fact possible to set up Debian to automatically update all of the things and reboot if necessary. Is it smart? Probably not. Do I use it? Yes.

There are plenty of tutorials online for enabling automatic updates only for vital security patches, without automatic rebooting. This isn't that. This is more of a bull-in-the-china-shop update-everything-without-asking-and-reboot, nails & broken glass for breakfast kinda deal.

In all seriousness, I use the unattended-upgrades package to automatically update non-vital virtual machines that I take nightly backups of. That way if anything goes wrong it's as simple as restoring from Proxmox backup server. I do NOT use unattended-upgrades on my Hypervisor, NAS, Backup Server, or any other vital systems.

If you choose to forge forward, first you'll need to install the package:

apt install unattended-upgrades -y

Now let's remove the existing config and edit a new blank one:

rm /etc/apt/apt.conf.d/50unattended-upgrades
nano /etc/apt/apt.conf.d/50unattended-upgrades

Now replace the contents with this:

Unattended-Upgrade::Origins-Pattern {
    "origin=*";
};

Unattended-Upgrade::Package-Blacklist {
};

Unattended-Upgrade::AutoFixInterruptedDpkg "true";

Unattended-Upgrade::MinimalSteps "true";

Unattended-Upgrade::InstallOnShutdown "false";

Unattended-Upgrade::Remove-Unused-Kernel-Packages "true";

Unattended-Upgrade::Remove-New-Unused-Dependencies "true";

Unattended-Upgrade::Remove-Unused-Dependencies "true";

Unattended-Upgrade::Automatic-Reboot "true";

Unattended-Upgrade::Automatic-Reboot-WithUsers "true";

Unattended-Upgrade::Automatic-Reboot-Time "now";

Unattended-Upgrade::OnlyOnACPower "false";

Unattended-Upgrade::Skip-Updates-On-Metered-Connections "false";

Unattended-Upgrade::Allow-APT-Mark-Fallback "true";

Now let's enable it and start the service (It will prompt for confirmation.):

dpkg-reconfigure --priority=low unattended-upgrades
systemctl start unattended-upgrades
systemctl enable unattended-upgrades

By default this runs at 6am every day using a systemd timer. You can check that out or edit the time here; It's pretty self explanatory:

nano apt-daily-upgrade.timer

All Done!

Read more